Please find below the European Data Protection Supervisor’s (EDPS) latest press release, dated 29 October 2026, titled: EU-US border information exchange: effective safeguards are essential to protect fundamental rights in practice.
On 10 September 2026, the European Commission issued a proposal for a framework agreement between the European Union and the United States that would set common conditions for reciprocal exchange of information between the authorities of EU Member States and the US for the purposes of border checks, travel authorisations and visas. In its Opinion published today, the European Data Protection Supervisor (EDPS) sets out the safeguards needed to keep the processing of personal data limited to what is strictly necessary and proportionate.
The proposed arrangement would facilitate identity verification, screening and vetting of travellers to determine whether their entry would pose a serious and genuine risk to public security or public order. The US has made it a requirement for partner countries in the US Visa Waiver Program to conclude an ‘Enhanced Border Security Partnership’ with the US Department of Homeland Security by the end of 2026, which is why the Commission proposes provisional application before this agreement officially enters into force.
Wojciech Wiewiórowski, Supervisor, said: “This would be the first time the EU agrees to share personal data, including biometrics, with a third country on this scale for border control. All the necessary safeguards must be in place to ensure the protection of individuals, including real oversight on both sides of the Atlantic.”
The EDPS’s key recommendations:
- The national information systems from which data is to be exchanged should be carefully chosen so that only relevant and necessary data is shared.
- The possible offences considered as presenting risks to ‘public order’ and ‘public security’ should be clearly specified in the resultant bilateral agreements.
- The bilateral agreements should further specify what criteria need to be fulfilled for a ‘nexus’ to a given country to exist (where a nexus is what links the traveller to an EU Member State or the US). Considering the principle of proportionality, this nexus should be defined, concrete and verifiable.
- Competent authorities should be required to establish an objective link between the risk to public security or public order and the individual concerned on a case-by-case basis. Requesting competent authorities should, as a rule, indicate the specific reasons for believing that an individual may pose a risk or, at least, the nature of the identified risk.
- Competent authorities that share data should be informed of the onward sharing of that data in an effective manner.
The EDPS calls on the Commission to monitor whether judicial redress is available in practice for anyone impacted by these measures, regardless of their citizenship or nationality, and to regularly monitor for serious human rights violations as a ground for possible suspension or termination of the framework agreement.
While the framework agreement clearly identifies the data protection authorities of EU Member States as their oversight bodies, the same clarity is not provided on the US side. As such, the US should be required to formally notify the EU, before the provisional application of the agreement, which of its supervisory authorities it intends to give competence in this matter, including their specific tasks and powers, and of any future changes in this respect.
Questions can be directed to press@edps.europa.eu.
European Data Protection Supervisor