Turns out the company in questioned already was bought by a UK company, so already isn't even Dutch (or even EU anymore). But at least it's not American (the concern is that American laws potentially give the American government a lot of access to the Dutch citizen data). Companies owned by companies. It gets complicated.