EU to Share Biometric Data with US for Visa-Free Travel
European Union countries are preparing to grant the United States access to national biometric databases containing sensitive personal data, including fingerprints and facial scans. This access is being negotiated as part of a condition set by the U.S. to maintain visa-free travel for EU citizens. The U.S. demands this data sharing under the “Enhanced Border Security Partnerships” (EBSP) program, which applies to all EU countries except Romania, Bulgaria, and Cyprus. The European Commission is expected to lead talks this year to establish a framework that will govern how these partnerships operate.
The EU-wide framework will specify the types of databases and categories of data the U.S. may access, while individual EU member states will negotiate directly with the U.S. government to determine which national databases and personal data will be shared. Denmark and Ireland will not participate in the framework due to their special arrangements with the EU. Despite tensions between the EU and the U.S. over trade and rule-of-law issues, most EU governments have approved the Commission’s mandate to negotiate the framework.
The data to be shared could include sensitive information such as ethnic origins, political opinions, religious beliefs, genetic data, and biometric details. The European Commission emphasizes that data transfer should be strictly necessary and proportionate to preventing criminal or terrorist acts, with safeguards in place, including limits on data retention periods. However, concerns remain about the implications of sharing such sensitive data, especially given recent U.S. actions affecting EU officials and citizens.
The European Data Protection Supervisor supports the framework but insists on narrowly defining the data to be transferred and limiting it to individuals actually traveling to the U.S. The U.S. aims to have the data access system operational by the end of the year, adding pressure to the negotiations. The final agreements will need to balance security interests with strong data protection standards to comply with EU laws, including the General Data Protection Regulation (GDPR).
