EDRi frames the deal as the US using Visa Waiver Program access as leverage to force EU member states into surrendering automated query access to national fingerprint, facial-image, and criminal-records databases. They argue the 'sign or lose visa-free travel' ultimatum is coercion, not partnership, and that the scope — population-wide queries with no case-by-case judicial authorization — goes far beyond the older PCSC framework it replaces.
By submitting the EDRi piece with the framing 'The EU is about to sell our most sensitive data to the US for visa-free travel,' rapnie endorses the transactional-coercion reading — that visa-free travel is being traded for citizens' biometric data without their consent.
EDRi and its coalition partners (Access Now, Statewatch) argue the EBSP is incompatible with the Charter of Fundamental Rights, the Law Enforcement Directive, and the Schrems II ruling on transatlantic data transfers. They note that law enforcement cooperation is being used as a venue precisely because GDPR does not apply there, effectively routing around the EU's decade-long data-protection settlement.
EDRi highlights that the Commission has refused to publish the negotiating mandate, and that documented objections from Germany, Austria, and Ireland in Council working groups have been ignored. They argue a deal of this constitutional magnitude cannot be legitimately concluded through closed-door bilateral pressure with no public deliberation.
European Digital Rights (EDRi) has published a detailed analysis of the Enhanced Border Security Partnership (EBSP), a program the US government is pressuring EU member states to join before the end of 2027. The stakes are blunt: sign a bilateral agreement giving US federal agencies automated, query-based access to national fingerprint, facial-image, and criminal-records databases, or lose participation in the Visa Waiver Program that lets EU citizens enter the United States without a visa.
The EBSP replaces the older Preventing and Combating Serious Crime (PCSC) framework with something significantly broader: real-time, automated "hit/no-hit" queries against biometric identifiers, extended to include facial recognition and, in some drafts, DNA profiles. The requesting US agency — CBP, ICE, FBI, or any of the roughly 20 entities with access — sends a probe; the EU member state's system responds with a match indicator, followed by full personal data on any hit. Crucially, the queries can be run on entire populations, not just travelers or suspects, and there is no case-by-case judicial authorization required on the EU side.
EDRi and a coalition including Access Now, Statewatch, and national digital-rights groups argue the agreement violates the Charter of Fundamental Rights, the Law Enforcement Directive, and the Schrems II judgment on transatlantic data transfers. The Commission has so far declined to publish the negotiating mandate, and several member states — Germany, Austria, and Ireland among them — have reportedly raised objections in Council working groups, without result.
The surface story is a familiar one: a big trading partner uses market access as leverage to extract data concessions. The deeper story is that the EU's data-protection posture, which the industry has spent a decade internalizing as bedrock, is being renegotiated in a forum where GDPR simply does not apply. Law enforcement cooperation falls under the Law Enforcement Directive (LED), which has weaker purpose-limitation, thinner redress rights, and — critically for engineers — no equivalent of the Article 46 transfer-mechanism machinery that DPOs spend their days on.
Compare this to the last three transatlantic data fights. Safe Harbor was struck down in 2015. Privacy Shield fell in 2020 (Schrems II). The current EU-US Data Privacy Framework, adopted in 2023, is already being challenged at the CJEU on the grounds that FISA 702 and Executive Order 14086 don't provide "essentially equivalent" protection. If that framework falls again — which most privacy lawyers now assume is a matter of when, not if — commercial transfers will be back in limbo. But EBSP creates a parallel channel entirely: a law-enforcement pipe that doesn't depend on the commercial framework at all, is harder to litigate against, and carries data types (biometrics, criminal records) that are far more sensitive than the ad-tech telemetry that dominated the Schrems cases.
The community reaction on Hacker News (234 points) and in European tech press has focused on two threads. The first is the coercion optics — a country that revoked its own membership in the Iran nuclear deal and the Paris Agreement demanding automated access to European fingerprint databases as a condition of tourist visas. The second is the technical asymmetry: the US receives real-time query access to 27 national databases; EU states receive access to a US-side interface that historically has been slow, incomplete, and gated by discretionary review. EDRi's brief notes that of the countries that have signed PCSC agreements, none have reported anything resembling reciprocal utility.
There is also a specifically European-tech dimension. The AI Act, which entered force in August 2024, explicitly prohibits real-time remote biometric identification in public spaces except under narrow law-enforcement carve-outs, all requiring judicial authorization. EBSP appears to route around this by treating biometric queries as a data-sharing operation rather than a biometric-identification operation — the same legal fiction that has let Europol expand its Prüm II system without triggering AI Act obligations. If that reading holds, the AI Act's biometric red lines have a very large door quietly left open behind them.
If you are building anything that touches identity, KYC, immigration, HR-tech, travel, or law-enforcement adjacent products in the EU, three things change in your threat model.
First, onward transfer to US law enforcement is no longer a hypothetical. Under GDPR you can build a defensible transfer story with SCCs, TIAs, and encryption-at-rest. Under EBSP-adjacent flows, the data your customer's national police force holds — including data you submitted for a legitimate KYC or right-to-work check — can be queried by a US agency without notifying the data subject, and without a mechanism for the data subject to find out after the fact. If your product's privacy policy promises "we do not transfer your data outside the EEA," that promise is now true only in the commercial sense, not the operational one, and your users increasingly know the difference.
Second, biometric templates are now radioactive in a new way. Storing a face embedding or fingerprint template to enable a "log in with your face" feature used to be a GDPR Article 9 problem — expensive, but manageable. Now those same templates, if they end up in a national database via any downstream integration (police, border, national ID), are one automated query away from a US federal system. The engineering answer is the one biometrics researchers have been advocating for a decade and industry has ignored: don't store raw or reversible templates, use cancelable biometrics or fully on-device matching, and treat any server-side biometric store as a liability center rather than a feature.
Third, audit logging becomes a compliance product, not an internal one. The EBSP text, in the drafts EDRi has seen, requires logging of queries but not of subsequent data use. If your product handles data that flows into a national database subject to EBSP queries, your customers' DPOs are going to start asking for query-level provenance — who touched this record, when, under what authority. Systems that can answer that question at row-level will have a real commercial advantage over systems that log at the API-call level.
The political timeline is short. Member states have until 2027 to sign or lose visa waiver access, and the first bilateral agreements are expected to be initialed in early 2026. EDRi, Access Now, and MEPs from the Greens and Left groups are preparing a legal challenge, but the CJEU will not rule before the agreements are already operational. For working developers, the practical move is to stop treating GDPR as the ceiling of your privacy engineering and start treating it as the floor — because the ceiling is being renegotiated in rooms your compliance team isn't in, and the direction of travel is not toward more protection.
It's not clear to me if this would allow access to all biometric data, or "just" to that of people crossing the US border?And for the latter, what data are we talking about? If it's mostly fingerprints, don't those already get collected upon crossing the border? And can'
This is a good thing for travellers.In border security there are generally two camps, one that uses data and intelligence to go after the worst, large-scale criminal operations and networks, and generally makes travelling easy for the average person, and the other is like traditional cops using trad
I fail to understand the distinction between an ESTA and a visa to be honest. You need to do the paperwork in advance, pay, provide all sort of personal information, and it can be denied, and if approved only for a limited amount of time. Given that both the EU and the UK have reciprocated, it is a
It shouldn't be possible for the US to request this data without the passport being physically present at a US entry facility (border, airport checkin scan, consulate) where fingerprints/photos are actually compared.Before that point, only passport information tuples should be queryable, i
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
The point missing in the article is that, in order to enter the US, one needs to give the US Govt their photo and fingerprints ("biometric data") anyway.There are two options: visa-free with the biometric data passing on the wire (no hassle), or visa (a major hassle) and biometric data pas