EU governments have formally approved the launch of negotiations with the United States on a framework agreement that could grant US border authorities access to sensitive biometric data stored in national databases across the bloc. This includes fingerprints and facial images.
The decision, adopted by EU ministers in December, authorises the European Commission to negotiate an EU-US framework governing the exchange of personal data for border screening and identity verification purposes
The move follows a 2022 US requirement that all countries participating in, or seeking to join, the US Visa Waiver Programme conclude an “Enhanced Border Security Partnership” (EBSP) with the Department of Homeland Security. Without such agreements, visa-free travel to the US could be suspended.
National biometric databases
According to the Council decision and accompanying negotiating directives, the planned framework agreement would allow the exchange of “information, including biometric data” for the screening and verification of travellers. The motive is to determine whether their entry or stay would pose a risk to public security or public order
Crucially, the framework agreement itself would not give US authorities direct access to EU databases. Instead, it would establish the legal conditions under which EU member states would later conclude bilateral agreements with Washington. This would define which specific databases and categories of data are made accessible.
You might be interested
The Council Presidency note makes clear that exchanges should focus on national databases. Each member state retains discretion, under its own laws, over which systems and data are included.
However, the document also states that data shared for border screening purposes could subsequently be used, if authorised by bilateral agreements, to address irregular migration and to prevent or combat serious crime and terrorism. This is only provided in the context of border management.
Visa-free travel as leverage
The Council note explicitly links the framework agreement to member states’ “commitment to participate in the Visa Waiver Programme”. It warns of the negative consequences for transatlantic relations should participation be terminated.
The US expects operational EBSP arrangements to be in place by the end of 2026. After it will assess compliance country by country. As of now, all EU member states except Bulgaria, Romania and Cyprus participate in the programme. Denmark and Ireland will not be bound by the framework agreement. Denmark is excluded due to treaty opt-outs and Ireland is not part of the Schengen area.
EU safeguards promised
The negotiating mandate repeatedly stresses that the future agreement must respect EU data protection law and fundamental rights. It cites the EU Charter of Fundamental Rights, the GDPR, the Law Enforcement Directive and the Artificial Intelligence Act. It calls for clear purpose limitation, specific triggers for data exchange, and safeguards to avoid mass transfers of data.
At the same time, many of the most consequential decisions, including the precise scope of biometric access, technical safeguards, retention periods and oversight mechanisms, are explicitly deferred to bilateral negotiations between individual member states and the United States.
The European Data Protection Supervisor was consulted in September 2025. The body warned that the EBSP framework would set an important precedent as the first EU agreement enabling large-scale transfers of personal data to a third country’s border authorities.
Civil society warns of precedent
Digital rights groups argue that the approach risks normalising access to biometric data as a condition for mobility. “Locking transatlantic biometric data sharing into visa-free travel would create a system of biometric mass surveillance under the guise of promoting mobility and security”, said Aljosa Ajanovic, policy advisor at EDRi.
“At this stage, it is unclear how US authorities would gain access to EU national biometric databases, or how such access would be secured, governed, or audited. Even without those details, the proposal itself raises serious concerns about fundamental rights”, he said.
“Locking transatlantic biometric data sharing into visa-free travel would create a system of biometric mass surveillance” – Aljosa Ajanovic, policy advisor at EDRi
Ajanovic warned that making visa-free travel conditional on granting a third country access to biometric datasets sets a dangerous precedent. “Biometric data, considered ‘sensitive’ by EU law, cannot be changed or revoked once compromised, and its processing carries heightened risks of misuse”. He argued that this risks undermining core data protection principles such as purpose limitation and data minimisation.
He also questioned the political context of the negotiations. EU-US relations remain strained, and details of the agreement have advanced with little public debate. “The EU should not endorse a model in which data protection is weakened by exporting sensitive personal data to jurisdictions with uncertain or unenforceable safeguards”.
Tight timeline
According to the Council, negotiations with the US are expected to begin as soon as the decision enters into force. The document points to ’very tight timeframe’ imposed by Washington. While member states are urged to refrain from parallel bilateral talks, and any eventual framework agreement would still require European Parliament consent, followed by national approval procedures
