The decision by state-owned railway operator NS to move critical technical hosting applications to US technology company DXC has drawn criticism from privacy experts and lawmakers, who say the arrangement could expose parts of Dutch mobility infrastructure to US jurisdiction under the Cloud Act.