EU sends US biometric border-sharing deal to Council as deadline looms

The European Commission has sent a finalized U.S.-EU border data-sharing framework to the Council of the European Union for approval to sign and provisionally apply, moving a potentially far-reaching system for reciprocal biometric and identity checks closer to operation as Washington’s year-end Visa Waiver Program deadline approaches.

On September 10, the Commission proposed that the Council authorize the signing and provisional application of the Framework Agreement on Enhanced Border Security between the European Union and the U.S. It separately proposed that the council eventually conclude the agreement after obtaining the consent of the European Parliament.

Negotiations with the U.S. were completed on July 23. The agreement has not yet been signed or concluded, and the council procedures remain underway.

The framework would establish common rules governing how U.S. authorities and participating EU member states may query one another’s national information systems, including fingerprint records, when conducting border checks or considering visa and travel authorization applications.

But the agreement itself does not open European databases to the Department of Homeland Security (DHS).

It expressly states that the framework “in and of itself” is not a legal basis for transferring personal information. Exchanges may occur only to the extent authorized and further specified in bilateral Enhanced Border Security Partnership (EBSP) agreements between individual member states and the U.S.

Those agreements must identify the national information systems involved and comply with the conditions established by the EU-U.S. framework. Existing EBSP agreements would have to be brought into compliance, while other member states could negotiate new ones once provisional application begins.

Ireland and Denmark are outside the EU framework because of their respective positions under EU treaty protocols.

The process is being driven by a December 31 deadline. DHS made EBSP agreements a condition for admission to and continued participation in the Visa Waiver Program in 2022 and plans to assess countries’ compliance after the deadline.

The Commission says that makes provisional application urgent, allowing member states to negotiate and conclude bilateral agreements once the EU-U.S. framework is signed and provisionally applied.

The finalized agreement resolves one of the central issues that shadowed the negotiations by imposing conditions intended to prevent indiscriminate automated searches of every traveler.

During consideration of a visa or travel authorization application or a border check, an authority may submit an automated query only when there is reason to believe that the person’s entry or stay could present a “serious and genuine risk to public security or public order.”

That finding may be based on indications of identity fraud or misuse, concerns about the authenticity of travel documents, suspected false information in a visa application, risk assessments based on trends in suspicious activity, law enforcement cases or criminal intelligence, or information already held about the person.

There are additional restrictions. The person must have a nexus to the country whose information system is being queried.

The agreement gives examples including citizenship or nationality, current or former residence, a previous stay in that country, or an application to stay there. The requesting authority also must search its own national systems when initiating the foreign query.

The agreement nevertheless anticipates potentially significant volumes of automated screening. It says bilateral agreements will establish maximum volumes based on actual travel, current risks, technical capacity and reciprocity.

First-stage automated queries may use identity information from an application or travel document and fingerprints. Facial images are not authorized as a biometric search input.

A match returns confirmation and identifying information such as name and date of birth and may include a photograph where domestic law permits. It does not automatically release the underlying law enforcement, immigration or other record.

The authority holding the information must first assess whether the match relates to the public-security or public-order risk covered by the agreement. Additional information can then be requested, with its release subject to a human assessment and the terms of the applicable bilateral agreement.

The framework applies to U.S. nationals, EU citizens and third-country nationals and includes a reciprocity mechanism. If one side cannot exchange information concerning its own citizens, the other may withhold equivalent information about its citizens. Reciprocity is also expected in query volumes and the type and quality of information exchanged.

The final text does not preserve all the stronger protections in the Commission’s original July 2025 negotiating recommendation.

Brussels initially proposed prohibiting significant adverse decisions based solely on automated processing without human involvement. Article 21 of the final agreement instead allows such decisions where domestic law authorizes them and provides safeguards, including the possibility of human intervention.

The agreement does not specify when that intervention must occur.

Special-category information beyond biometrics used for identification may also be transferred when it is “particularly relevant” to determining whether a person presents the specified risk, but a human assessment is required before its release. The agreement calls for appropriate safeguards without mandating every possible protection in every case.

The finalized agreement also does not establish a uniform maximum period for retaining transferred information.

Instead, the U.S. and participating member states must set specific retention periods under their respective legal frameworks and ensure they do not retain information longer than necessary and appropriate.

Member states must review these periods at least annually.

The commission’s original negotiating recommendation was more specific. It proposed limiting retention after a traveler left the jurisdiction to cases in which objective evidence indicated a continuing public-security or public-order risk and a continuing need for the information. That language does not appear in the finalized agreement.

Another substantial change concerns what happens to information after it crosses the Atlantic.

The commission’s July 2025 recommendation said onward transfers from U.S. authorities to third countries or international organizations should be prohibited.

The finalized agreement permits such transfers.

The framework may allow transfers to a public authority in another country or to an international organization if the authority that originally supplied the information gives prior consent.

When deciding whether to consent, that authority must consider the original purpose of the transfer and whether the third country or international organization provides an “appropriate level” of protection for personal information.

Information may also be shared within the receiving country with other national law enforcement, regulatory, or administrative authorities, provided the protections in the agreement’s data-protection section continue to apply.

The agreement establishes rights to access and correct personal information and requires both sides to provide effective administrative and judicial remedies when information is handled inconsistently with the agreement.

European oversight would be carried out by member-state data protection authorities. U.S. oversight may be divided among several privacy, accountability and inspector-general bodies.

Those protections will receive renewed scrutiny as the agreement proceeds.

The European Data Protection Supervisor (EDPS) warned during negotiations that the framework could become the first EU agreement involving large-scale sharing of personal and biometric information for border and immigration control by a third country.

The EDPS supported establishing common EU safeguards rather than leaving member states to negotiate independently, but urged that the system’s scope be defined narrowly, processing be limited to what is strictly necessary and proportionate, and judicial redress in the U.S. be available regardless of citizenship.

The commission acknowledges that transferring information under the framework and having it processed by authorities of another country interferes with fundamental rights to privacy and data protection. It argues that the interference is justified by the agreement’s border-security objectives and accompanying safeguards.

A joint U.S.-EU committee would meet at least annually to oversee implementation. The first joint review must occur no later than three years after the agreement formally enters into force, and the committee is to receive statistics including the number and nature of queries, the number and percentage of matches, and response times.

The immediate next step, however, is political rather than technical.

The Council must now authorize signature and provisional application, while formal conclusion will later require European Parliament consent.

Even provisional application would not create a direct U.S. gateway into European databases. The practical reach of the system will ultimately be determined through bilateral EBSP agreements specifying which national databases can be queried and what information can be exchanged.

Article Topics

biometrics  |  cross-border data sharing  |  Enhanced Border Security Partnership (EBSP)  |  European Commission  |  U.S. Government  |  United States