It's an unfortunate Dutch way of doing things. The firm believe that the market will solve it if you have a contract that says thing will be solved. Write a tender, pick the cheapest party, trust in contracts, hope it won't break before you (the external contractor pushing for it) move on in a few months time.

The people who pointed out that none of the moving parts of DigiD should have been outsourced were ignored until the tide shifted this year.

I'm honestly surprised the government decided to intervene. The usual method is to keep on believing in the signed piece of paper until the shit hits the fan (like with the Fyra high speed trains) — never mind that the US (where the buyer is from) is not likely to give a toss about those pieces of paper if they need something from our data.

> Why did they not mandate national (or at least EU-based) hosting and infra ?

They did, and they moved to block the acquisition of the local company handling it. What's unclear in the article?