Trading Privacy for Passports: The EU's Risky Data Deal with the US

The European Commission is currently in the final stages of negotiating an Enhanced Border Security Partnership (EBSP) Framework Agreement with the Trump administration. This deal would grant border authorities the power to profile travelers and screen them against biometric databases to identify "security concerns."

According to leaked documents, the Commission has largely surrendered to the US's aggressive demands for unrestricted data access, which threatens to escalate travel surveillance and undermine fundamental human rights.

By EDRi | July 20, 2026

The Cost of Visa-Free Travel

Since 2022, the United States has made it clear: if EU Member States want their citizens to keep the privilege of visa-exempt travel, the US must have access to their biometric databases. This is the core of the EBSP scheme—an automated system for verifying identities and screening passengers.

Timeline of the Agreement

The intended "Framework Agreement" will establish the general rules for data processing and exchange. Once this umbrella agreement is set, individual EU countries will either sign their own bilateral EBSP deals or update existing ones.

A Dangerous Power Imbalance

The US's insistence on deep profiling as a condition for the Visa Waiver Programme is viewed by critics as a form of geopolitical coercion.

"The US's excessive demands for travellers' profiling and surveillance in order to stay in its Visa Waiver Programme are nothing less than blackmail."

The implications are severe. The deal involves the systematic transfer of biometric data and subjective "risk indicators" to a US government that has a documented history of inhumane treatment of visitors and migrants.

Key Risks and Concerns

• Political Discrimination: The draft lacks protections against discrimination based on political beliefs.
• Social Media Surveillance: The US already unlawfully screens the social media profiles of travelers.
• Targeting Dissent: "Public security" justifications could be used to target:
  • Opponents of the Trump administration.
  • Advocates for transgender rights.
  • Those protesting the genocide in Gaza.
• Consequences: These profiles could lead to immediate detention at US borders.

The Legal Vacuum

The negotiations have been conducted in near-total secrecy. However, the leaked text suggests the EU has ignored its own legal standards.

{
  "agreement_status": "Draft",
  "compliance": {
    "EU_Primary_Law": false,
    "Charter_of_Fundamental_Rights": false,
    "Negotiation_Mandate": "Departed"
  },
  "data_access": "Unfettered"
}

From a legal standpoint, the EU requires that international data transfers maintain an "essentially equivalent" level of protection. This can be expressed as:

$\text{Protection}_{\text{EU}} \approx \text{Protection}_{\text{US}}$

However, in this case, $\text{Protection}_{\text{US}} \ll \text{Protection}_{\text{EU}}$, meaning the Court of Justice of the EU would likely find the agreement illegal.

The Path Forward

The EU is essentially attempting to protect citizen privacy trade away sensitive data for travel convenience. EDRi argues that a truly strong Europe relies on a robust rulebook, not on bowing to US pressure.

EDRi's Demands for the Commission and Council:

• Resist US "blackmail" tactics.
• Refuse to export personal data to a country with democratic backsliding.
• Uphold the Charter of Fundamental Rights.
• Strengthen protections against data exploitation.

Data Flow Logic