EU Divisions on US Border Biometric Data Sharing Framework Persist

European Union governments are still at odds over a proposed framework that would enable U.S. authorities to query EU national databases containing biometric and personal information. This data access would be used for screening travelers and individuals encountered during border and immigration processes in the U.S. Source.

Ambassadors from EU member states are currently considering a compromise text, but "substantial concerns" remain regarding the agreement's scope, the model for information sharing, and safeguards related to data processing, retention, and transfers. Sensitive personal data also remains a point of contention.

The Mandate for Biometric Data Access

This dispute originates from a U.S. requirement, introduced in February 2022 and upheld by the current administration, for countries participating in the Visa Waiver Program (VWP) to establish an Enhanced Border Security Partnership (EBSP) with the Department of Homeland Security (DHS). The deadline for concluding these agreements is December 31, after which DHS will assess compliance for continued VWP participation.

Most EU countries are part of the VWP, making these negotiations crucial for transatlantic travel. In December 2025, the Council of the European Union authorized the European Commission to negotiate a framework for reciprocal exchanges related to security screening and identity verification at borders and for visa applications.

Core Disagreements and Concerns

The U.S. request goes beyond isolated law enforcement inquiries. According to a European Parliamentary Research Service briefing, the EBSP would allow DHS to routinely screen against partner country biometric databases. This broad application for travelers, asylum applicants, and others encountered at the border has elevated data protection concerns.

The European Data Protection Supervisor (EDPS) views this as potentially the first EU agreement with a non-EU country involving large-scale sharing of personal and biometric data for border and immigration control. While supporting common EU safeguards, the EDPS urged that the agreement's scope be narrowly defined and processing limited to what is necessary and proportionate.

Automated Decisions and Sensitive Information

One significant point of contention is automated decision-making. A draft text suggests that decisions with "significant adverse effects" should not be based solely on automated processing unless authorized by U.S. or participating European country law. Even then, safeguards, including individual access to human intervention, would be required.

This language leaves open the possibility that automated decisions could be made before human review, depending on implementation. It also doesn't explicitly define "significant adverse effect" or the timeline for human intervention. This also impacts the potential role of algorithms in border and immigration screening.

Sensitive information transfer is another unresolved issue. The Commission's original proposal allowed for transfers, in individual cases, of data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic information, health, sexual life, or sexual orientation. This was contingent on strict necessity for preventing crime and terrorism, with appropriate safeguards.

DHS has indicated it may seek biographical information, travel document data, convictions, arrests for serious crimes, and immigration status after a biometric match. The EDPS cautioned that national police files might contain unreviewed arrest records or criminal intelligence, and stressed the need for judicial redress in the U.S. for all individuals, regardless of citizenship.

Data Retention and Further Processing

Unresolved questions persist regarding how long U.S. agencies can retain data, when information can be used for other purposes, and under what conditions it can be shared with other authorities. Concerns about safeguards for further processing and onward transfers have not been fully addressed, leading to continued government resistance inside the EU.

This disagreement highlights that the core issue is no longer just whether a fingerprint can be matched against an EU record, but the subsequent data flow – what information follows a match, the role of automated systems, data retention by the U.S., and the enforceability of European data protections once information crosses the Atlantic.