Responding to the EU-US Negotiations on Reciprocal Data Exchanges for Border Procedures

Responding to the EU-US Negotiations on Reciprocal Data Exchanges for Border Procedures Under the pressure of a December 2026 deadline, the European Commission is rapidly steering EU-US border negotiations toward an unprecedented, large-scale sharing of sensitive data that bypasses established EU fundamental rights protections. Known as the Enhanced Border Security Partnership (EBSP), this framework would mandate continuous, systematic transfers of European biometric and genetic data to U.S. databases. Under the current terms, failure to comply by 31 December 2026, as signalled by the U.S. negotiators, would result in the revocation of the US Visa Waiver Program, a mechanism permitting citizens of most EU countries to travel to the U.S. without a visa. The terms under negotiation would permit the exchange of information for security screenings and identity verifications, including the large-scale sharing of personal data such as fingerprints, photographs, and genetic information from Member State databases for the purposes of border and immigration control. This is critically important because this information will be used to fuel the oppressive immigration enforcement system in the U.S. In that system, Europeans and other third-party nationals can be removed or excluded from the U.S. based on their political opinions expressed at a protest, can have their cell phones and computers confiscated and searched at the border, can be detained for lengthy periods based on their social media posts, and have extremely limited rights to challenge any immigration-related abuses that they may suffer. Broadly echoing the concerns of advocates, we are worried that the European Commission is seriously deviating from the narrow negotiating mandate set forth by the Council of the EU and is disregarding the advice for fundamental rights impact assessments and additional precautions outlined by the European Data Protection Supervisor. As a result, the negotiations as they currently stand, fail to uphold vital EU legal protections. Of principal concern are the divergences between the drafted framework agreement and established EU standards, set out in detail by a broad coalition of advocates. We are particularly concerned by three shortcomings: - Automated Profiling and Safeguards: As it stands, the framework runs the risk of discriminatory profiling as sufficient to make decisions “producing significant adverse actions,” with human review necessary only in instances of appeal. If indeed AI systems are used in this automated process to summarise, infer, or predict additional data regarding individuals, such actions would be considered high-risk under the EU AI Act and require additional compliance. - Failure of Purpose Limitation: The EBSP data sharing framework is permissive, failing to meet strict purpose limitation principles. For reasons of public security or order, the data of EU citizens and third-country nationals can be further processed for “compatible purposes.” We are concerned by this widened scope for the use of individual’s data without clarity or justification and the potential for long-term mission creep. - Limited Redress Guarantees: The draft fails to ensure independent data protection oversight within the U.S., which is particularly concerning given the eroding balance of adequate protections for personal data between the EU and the U.S. As outlined in the current draft, redress options are subject to U.S. law which largely excludes non-U.S. citizens and presents significant barriers to EU citizens and third party nationals seeking fulfillment of their rights to notification and other fundamental rights. This framework, as it currently stands, places the data of EU citizens, third-party nationals and U.S. citizens at risk while eroding the legal protections and fundamental rights afforded to individuals. Should the European Commission proceed with this drafted negotiation, they will be overreaching on their negotiating mandate while putting the rights of EU citizens and third-party nationals at risk. In response, CDT Europe, together with 29 other civil society organisations and academics, sent an open joint letter to the Council of the EU regarding this worrying direction taken by the European Commission in the negotiation with the U.S. government. Read the full open letter here.