Brussels is preparing to negotiate a data-sharing agreement with the United States that would grant American border authorities access to the fingerprints, facial scans, and sensitive personal data of European citizens, according to Euractiv.
Continued visa-free travel to America is the price tag; Washington set the terms.
The arrangement is called the Enhanced Border Security Partnership (EBSP). Under it, each EU member state would sign a bilateral agreement with the US Department of Homeland Security (DHS), opening its national biometric databases to American border officials.
EU ministers approved a mandate to begin negotiations in December 2025. No government raised a fundamental objection; the Council adopted the decision without debate.
What Data is on the Table
According to the Commission’s negotiating directives and a draft text obtained by Euractiv, the categories of data eligible for exchange go far beyond passport details.
Fingerprints and facial scans are the core of the proposal. But the draft also contemplates transfers of data revealing ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, and details about a person’s health or sex life, provided such transfers are “strictly necessary and proportionate.”
Basic identity information tied to travel documents would be shared automatically. More sensitive categories would require additional justification, though the precise thresholds remain undefined pending negotiation.
Adam Juchniewicz, CEO of Bitcitizen and a former US federal employee who spent 12 years at DHS, put it bluntly: “Visa-free travel shouldn’t require Europeans to export their most irreversible identifier: biometrics, into a system where their GDPR rights turn into polite suggestions.”
A Deadline That Functions as an Ultimatum
Washington has set a December 31, 2026, deadline for EBSP agreements to be operational. After that date, DHS will assess each country’s compliance during Visa Waiver Program (VWP) reviews. Countries that fail to meet US expectations risk suspension from the VWP, which would reimpose visa requirements on their citizens.
Twenty-four EU member states currently participate in the VWP. Bulgaria, Romania, and Cyprus are already excluded. For those 24, the implication is binary: share the data or tell your citizens they need visas to visit America.
The Commission’s negotiating mandate seeks to establish a single EU-wide framework rather than leave each capital to negotiate alone with DHS.
According to the Commission’s proposal, the agreement would “set out the legal structure and conditions for the exchange of information between the competent authorities of the EU Member States and of the US.”
Algorithms at the Border
A separate but related dimension of the draft concerns automated decision-making. As currently written, the text does not explicitly prohibit US authorities from using algorithms to assess EU travelers. Decisions with “significant negative consequences” for individuals may not be made solely by automated systems, unless US domestic law authorizes such procedures.
“Appropriate safeguards” would apply in that scenario, including the right to request human review. Whether any of this is compatible with the General Data Protection Regulation (GDPR), which restricts automated decision-making and applies extraterritorially, is a question the draft does not resolve.
Juchniewicz is less diplomatic about the carve-out. “If an algorithm can ‘judge’ a traveler unless US domestic law says otherwise, that’s not a safeguard, it’s a loophole with a PR ribbon on it,” he said.
The GDPR Collision
Europe’s data protection watchdog has acknowledged the gravity of the proposal.
In a September 2025 opinion, European Data Protection Supervisor (EDPS) Wojciech Wiewiórowski described it as the first EU agreement involving large-scale sharing of personal data, including biometrics, with a third country. He stressed that the processing of personal data under the agreement must not exceed what is strictly necessary and proportionate.
Whether that standard can survive negotiations with an administration that has simultaneously proposed requiring five years of social media history from all VWP travelers is a question the EDPS opinion does not answer.
That separate proposal, put forward by US Customs and Border Protection (CBP) in December 2025, closed its public comment period on February 9, 2026.
He framed the broader dynamic in starker terms. “This deal is a classic US-style trade: convenience now, accountability later. But with the US government, ‘later’ has a way of never showing up.”
The US, Juchniewicz added, would never accept an equivalent arrangement in reverse. “The irony and hypocrisy of this deal are obvious.” Europe keeps the boarding pass; Washington keeps the data, and the traveler keeps the risk.
Political Pushback, So Far Muted
Renew Europe MEP Raquel García Hermida-Van Der Walle has submitted written questions to the Commission and EU capitals, demanding to know why EU institutions agreed to open negotiations on sharing sensitive data with the US during a period of heightened transatlantic tension.
Hers has been a relatively isolated voice; no EU member state raised fundamental objections to the proposal, according to reporting by Statewatch, though several flagged concerns about timing, legal basis, and data protection.
“Similar Efforts Take Years”
David Lesperance of Lesperance & Associates urges perspective on the timeline. “It must be emphasized that this is a draft agreement in its earliest stage,” he told IMI. “There are a significant number of legal issues that must be dealt with, such as the GDPR, along with practical implementation issues.”
Lesperance points to recent border enforcement incidents as a source of legitimate concern for European travelers, but cautions against treating the EBSP as imminent.
“If one looks back at prior similar efforts such as the Western Hemisphere Travel Initiative, such programs take years to negotiate and then implement,” he said. That initiative, mandated by Congress in 2004 in the wake of the September 11 attacks, took five years to roll out fully, with its final phase reaching land and sea borders only in June 2009.
“One can safely predict that Kristi Noem will not be the head of DHS by the time this becomes a reality,” Lesperance added.
Juchniewicz, whose years inside DHS gave him a front-row seat to how the department handles large datasets, is less sanguine about the destination even if the timeline is long. “I’ve seen how big bureaucracies like the US government handle big data: it spreads,” he said. “If DHS is going to hold this much EU traveler data, it needs real technical controls, hard audit logs, and meaningful redress, because committee meetings don’t fix harmed people.”
He framed the broader dynamic in starker terms. “This deal is a classic US-style trade: convenience now, accountability later. But with the US government, ‘later’ has a way of never showing up.” The US, Juchniewicz added, would never accept an equivalent arrangement in reverse. “Europe keeps the boarding pass; Washington keeps the data, and the traveler keeps the risk.”
A Broader Tightening
The EBSP does not exist in isolation. It is one of several concurrent US moves expanding the volume of personal data collected from international travelers.
Under the proposed overhaul of the Electronic System for Travel Authorization (ESTA), social media disclosure would become mandatory, with additional fields covering biometric data, family members’ contact histories, and email addresses spanning ten years.
Several EU member states, including Ireland, the Netherlands, Denmark, Germany, and Finland, have already issued travel advisories concerning the US.
On its own side of the Atlantic, the EU is building parallel biometric border infrastructure. Its Entry/Exit System (EES), which captures fingerprints and facial scans from non-EU travelers at Schengen borders, has been in phased rollout since October 2025. Full implementation across all external borders is set for April 10, 2026.
A pre-travel screening system analogous to ESTA, the European Travel Information and Authorization System (ETIAS), is expected to follow in late 2026, with mandatory enforcement from 2027. Both sides of the Atlantic are assembling ever-larger databases of traveler data; the EBSP would connect some of them.
