The EU is about to sell our most sensitive data to the US for visa-free travel

Search How would you best describe that thing you're looking for?

About us Vision and Mission Team Network Board Victories Funding Annual reports What we do Our work Our topics Media relations Publications Decolonising digital rights Document Pools Take action Donate EDRi Manifesto for digital futures EDRi-gram newsletter Campaigns Events Jobs The EU is about to sell our most sensitive data to the US for visa-free travel The European Commission is currently finalising negotiations with the Trump administration to conclude an “Enhanced Border Security Partnership” (EBSP) Framework Agreement allowing border control authorities to screen travellers against biometric databases and profile them for security concerns. The leaked draft text suggests that the Commission significantly caved in to US’s excessive demands for unfettered information access, exacerbating travel surveillance and putting our fundamental rights at risk.

In 2022, the US government announced that it would require access to biometric databases of countries if they wish to keep visa exemption for their citizens travelling to the US , including European Union (EU) Member States. These new “Enhanced Border Security Partnerships” (EBSP) involve the automated exchange of personal data for the purposes of screening and identity verification of travellers.

While the European Commission started discussing the scheme with the US administration in 2022, it received the official mandate by the Council of the EU to lead the negotiations on behalf of Member States only in December 2025 . The goal of these negotiations is to establish a “Framework Agreement” which would set out the modalities of the information exchange and general rules on processing of personal data between the US and Member States. It is on this basis that EU countries would then adopt their own bilateral EBSP agreements directly with the US (or adapt their existing arrangements).

The US’s excessive demands for travellers’ profiling and surveillance in order to stay in its Visa Waiver Programme are nothing less than blackmail. The EU accepting the terms of this power struggle is extremely worrying for the rights of Europeans and any third country nationals registered in European databases.

The scheme implies systematic transfers of biometric data and other highly sensitive and subjective “indications of risk” based on European national databases to the US government, which has shown a blatant disregard for basic human rights in its harsh and inhumane treatment of migrants and visitors. In that regard, the draft text does nothing to protect from discrimination based on political opinions , which is worrying because the US is already cracking down political dissent , including its unlawful practice of screening travellers’ social media profiles . The sharing of individual risk assessments to supposedly protect “public security and public order” under the EBSP could further target opposition to the Trump administration , support to transgender people’s rights or protests against the genocide in Gaza expressed (publicly) on social media , with potentially significant impacts, including detention at the borders.

Furthermore it is very difficult to know the terms of the negotiations as the talks are shrouded in secrecy. However, in May 2026, EDRi member Statewatch leaked a “revised version” of the draft Framework Agreement, revealing the direction the future deal has taken.

According to EDRi’s analysis, the negotiated text seems to almost entirely reflect US demands for unfettered information access. This poses two major problems: (1) the text departs significantly from the Member States’ negotiation mandate; (2) its provisions are, in large parts, not compliant with EU primary and secondary law, notably the Charter of Fundamental Rights. Notably, they fall short of meeting EU fundamental requirement of reaching an essentially equivalent level of protection for international data transfers – something that the Court of Justice of the EU would have no doubt of and declare the agreement incompatible with EU law.

EU leaders must fight to protect our fundamental rights against yet another instance of the US bullying the EU into dismantling key safeguards. A strong Europe needs a strong rulebook and our lawmakers must be focused on strengthening core protections against data exploitation and privacy violations – rather than acquiescing to the whims of the US.

EDRi recommends the Commission and the Council to push back against the US government’s blackmail and refuse to sell people’s personal data to a country with a very worrying human rights violations record and rapid democratic backsliding.