Zivver Acquired: Is the protection of your highly sensitive data at risk?
On September 18th, questions were raised in the Dutch House of Representatives about the acquisition of the Dutch data security company Zivver by the American company Kiteworks. Zivver provides systems for the encrypted exchange of highly sensitive information, such as medical data, via email, chat, and video. Zivver’s clients include hospitals, healthcare institutions, government agencies, municipalities, and financial and legal service providers.
Although Zivver emphasizes that data will continue to be stored within the EU, its new American ownership raises concerns. Organizations relying on Zivver for the secure communication of highly sensitive data must now carefully assess the risks and consider potential alternatives.
The CLOUD Act and U.S. Regulations
As an American company, Kiteworks falls under the U.S. CLOUD Act. This law allows U.S. authorities to compel companies like Kiteworks to provide access to data they manage, even if that data is physically stored in Europe. In practice, this means that sensitive information could be requested by U.S. government agencies. Legally, Kiteworks must respect the privacy of EU citizens, but U.S. legislation can override this and enforce access. This means that:
- Sensitive data, such as patient records, municipal decisions, and legal communications, could be accessed by U.S. authorities;
- You may not be notified when such access occurs;
- Under the GDPR, you are obligated to continuously protect the privacy of EU citizens. Without realizing it, you may breach this obligation, exposing your organization to fines, legal claims, and reputational damage;
- Your reputation could suffer immediately if clients, patients, or citizens begin to doubt the safety of their data.
What you can do
Does your organization, a partner, or a client use Zivver to securely exchange highly sensitive information? Then consider taking the following steps:
- Assess the legal and technical risks associated with Zivver’s acquisition.
- Determine whether these risks are acceptable for your organization and stakeholders.
- Take action based on your risk assessment:
a. If you conclude that Zivver can still be used but want more assurance, consider negotiating additional agreements with Zivver, either individually or at an industry level.
b. If you conclude that Zivver is no longer a viable option, develop an exit strategy and begin exploring alternative solutions.
Support and advice from Highberg
Our experienced security and privacy experts can support your organization in taking these steps. We go beyond technical features and security: we also consider usability, legal compliance, and practical implementation in day-to-day operations. This ensures your organization makes well-informed decisions that are not only future-proof but also aligned with your strategic goals.
Want to know more? Get in touch with Arjen Bol.
Related Insights
