EU-US border information exchange: effective safeguards are essential to protect fundamental rights in practice

On 10 September 2026, the European Commission issued a proposal for a framework agreement between the European Union and the United States that would set common conditions for reciprocal exchange of information between the authorities of EU Member States and the US for the purposes of border checks, travel authorisations and visas. In its Opinion published today, the European Data Protection Supervisor (EDPS) sets out the safeguards needed to keep the processing of personal data limited to what is strictly necessary and proportionate.

The proposed arrangement would facilitate identity verification, screening and vetting of travellers to determine whether their entry would pose a serious and genuine risk to public security or public order. The US has made it a requirement for partner countries in the US Visa Waiver Program to conclude an 'Enhanced Border Security Partnership' with the US Department of Homeland Security by the end of 2026, which is why the Commission proposes provisional application before this agreement officially enters into force.

Wojciech Wiewiórowski, Supervisor, said: "This would be the first time the EU agrees to share personal data, including biometrics, with a third country on this scale for border control. All the necessary safeguards must be in place to ensure the protection of individuals, including real oversight on both sides of the Atlantic."

The EDPS's key recommendations:

• The national information systems from which data is to be exchanged should be carefully chosen so that only relevant and necessary data is shared.
• The possible offences considered as presenting risks to 'public order' and 'public security' should be clearly specified in the resultant bilateral agreements.
• The bilateral agreements should further specify what criteria need to be fulfilled for a 'nexus' to a given country to exist (where a nexus is what links the traveller to an EU Member State or the US). Considering the principle of proportionality, this nexus should be defined, concrete and verifiable.
• Competent authorities should be required to establish an objective link between the risk to public security or public order and the individual concerned on a case-by-case basis. Requesting competent authorities should, as a rule, indicate the specific reasons for believing that an individual may pose a risk or, at least, the nature of the identified risk.
• Competent authorities that share data should be informed of the onward sharing of that data in an effective manner.

The EDPS calls on the Commission to monitor whether judicial redress is available in practice for anyone impacted by these measures, regardless of their citizenship or nationality, and to regularly monitor for serious human rights violations as a ground for possible suspension or termination of the framework agreement.

While the framework agreement clearly identifies the data protection authorities of EU Member States as their oversight bodies, the same clarity is not provided on the US side. As such, the US should be required to formally notify the EU, before the provisional application of the agreement, which of its supervisory authorities it intends to give competence in this matter, including their specific tasks and powers, and of any future changes in this respect.

The rules for data protection in the EU institutions, as well as the duties of the European Data Protection Supervisor (EDPS), are set out in Regulation (EU) 2018/1725.

The EDPS is the independent supervisory authority with responsibility for monitoring the processing of personal data by the EU institutions, bodies and agencies, advising on policies and legislation that affect privacy and cooperating with similar authorities to ensure consistent data protection. Our mission is also to raise awareness on risks and protect people's rights and freedoms when their personal data is processed.

Wojciech Wiewiórowski (EDPS), was appointed by a joint decision of the European Parliament and the Council to serve a five-year term, beginning on 6 December 2019.

The selection procedure for a new EDPS mandate for the next term of five years is still ongoing.