On February 18, 2026, the Dutch Ministry of Justice and Security published a legal analysis of Amazon's "European Sovereign Cloud" — a service Amazon markets as a safe, Europe-based alternative to its standard US cloud offering. Three days later, the report was gone. The Ministry had deleted it from the official government website.
The reason? Experts said it underestimated the risks. Critics accused the Ministry's Strategic Supplier Management (SLM) department — which negotiates cloud contracts on behalf of the entire Dutch government — of having tunnel vision when it comes to American Big Tech.
The report was eventually republished on February 26 with a memo clarifying it was a purely legal analysis, not a policy recommendation, and not a risk assessment. The damage, however, was done: the episode put on display exactly how confused Dutch institutions are about the cloud they depend on — and how high the stakes have become.
What the report actually said
The Ministry commissioned the analysis from US law firm Greenberg Traurig. Their conclusion: it is technically possible for the US government to access Dutch data or suspend cloud services through law and informal pressure — but they considered it unlikely to happen.
An SLM employee then summarized the report on LinkedIn, calling it "highly unlikely" that the US would access Dutch government data and suggesting the product "potentially" aligns with Dutch digital sovereignty goals.
Critics were not impressed. The problem isn't just likelihood — it's dependency. As MP Barbara Kathmann of GroenLinks-PvdA put it, the SLM department has earned itself the nickname "the Dutch Ministry of Microsoft." European companies, she said, have already given up competing for Dutch government contracts.
The scale of Dutch dependence on American cloud
The Ministry's embarrassment sits against a backdrop that should alarm anyone responsible for managing sensitive data in the Netherlands. Research by Dutch broadcaster NOS found that 67% of Dutch government agencies, healthcare institutions, schools, and vital businesses are connected to at least one American cloud service.
Of 1,722 websites belonging to Dutch governmental or semi-governmental bodies, every single one relied on at least one US cloud provider. Nine of the fifteen Dutch ministries use Microsoft Teams or Webex for internal communication — tools that run on American infrastructure, potentially accessible to US authorities under the CLOUD Act.
The dependency extends to critical systems. DigiD — the government's identity verification system used by millions of Dutch citizens — was nearly acquired by an American firm when its operator Solvinity faced a US takeover. The deal could only have been blocked if deemed a threat to national security.
Why this matters for schools and tutoring institutions
Schools are not immune. Dutch universities, hospitals, and government agencies have all made the same trade-off: adopt American cloud services for their convenience and cost, accept the dependency as a manageable risk.
For tutoring institutions, the question is more direct. When you use Microsoft Teams or Zoom to run lessons, your students' video, audio, chat, and session data passes through American infrastructure. Under the US CLOUD Act, American authorities can compel providers to hand over that data — regardless of where the servers are physically located. It doesn't matter whether the data center is in Amsterdam or Dublin if the company is incorporated in the United States.
The Austrian case demonstrated this isn't hypothetical. When Microsoft blocked the email account of the International Criminal Court's prosecutor following US sanctions, it showed exactly how an American company can be forced to act against European users — with no European institution able to intervene. For schools, the parallel is clear: student data stored with US providers is ultimately subject to US law, whatever the contract says.
GDPR requires schools to know where their data goes, who controls it, and what law governs it. Using US-based platforms doesn't automatically violate GDPR, but it creates a layer of complexity that EU-hosted platforms avoid entirely.
Dutch alternatives exist — and work
The good news, as tech entrepreneurs told the Dutch parliament in January 2026, is that alternatives are available. According to Wido Potters of Dutch cloud provider BIT, Dutch and European suppliers can cover around 80% of what American companies currently provide — including data storage, software, and email systems.
The push is gaining traction. Multiple parties in the Tweede Kamer — including D66, VVD, CDA, GroenLinks-PvdA, and others — have acknowledged the urgency and called for concrete action. Motions have been passed demanding the government map its dependencies, develop exit strategies for American cloud services, and give European firms preferential treatment in public tenders.
The transition won't be instant. Dutch municipalities, schools, and healthcare institutions have spent years building workflows around Microsoft and Google. Switching takes time, budget, and retraining. But the political and security pressure isn't going away — and organizations that start planning now will have more options than those who wait.
What tutoring centers can do today
For a tutoring institution, the dependency problem is more tractable than it is for a ministry or a hospital. You're not running DigiD. You're running lessons, managing schedules, and communicating with students and parents. That's solvable with European tools.
At Simpleclass, we built a video conferencing platform specifically for Dutch tutoring institutions, hosted entirely in the EU — with servers in the Netherlands and France. We're not subject to the US CLOUD Act. Your students' session data never touches American infrastructure. The GDPR compliance isn't a checkbox we filled in after the fact — it's built into where and how the data is stored.
The Dutch government's cloud embarrassment is a symptom of how deeply American tech has embedded itself in European institutions — and how difficult it is to see alternatives when you've been inside the same ecosystem for years. For schools and tutoring centers, the exit is shorter than it looks. You just have to choose a platform that was never inside the American cloud to begin with.