On 10 September 2026, the European Commission issued a proposal for a framework agreement between the European Union and the United States that would set common conditions for reciprocal exchange of information between the authorities of EU Member States and the US for the purposes of border checks, travel authorisations and visas. In its Opinion published on 29 October 2026, the European Data Protection Supervisor (EDPS) sets out the safeguards needed to keep the processing of personal data limited to what is strictly necessary and proportionate.

The proposed arrangement would facilitate identity verification, screening and vetting of travellers to determine whether their entry would pose a serious and genuine risk to public security or public order. The US has made it a requirement for partner countries in the US Visa Waiver Program to conclude an ‘Enhanced Border Security Partnership’ with the US Department of Homeland Security by the end of 2026, which is why the Commission proposes provisional application before this agreement officially enters into force.

Wojciech Wiewiórowski, Supervisor, said: “This would be the first time the EU agrees to share personal data, including biometrics, with a third country on this scale for border control. All the necessary safeguards must be in place to ensure the protection of individuals, including real oversight on both sides of the Atlantic.”

The EDPS’s key recommendations:

• The national information systems from which data is to be exchanged should be carefully chosen so that only relevant and necessary data is shared.
• The possible offences considered as presenting risks to ‘public order’ and ‘public security’ should be clearly specified in the resultant bilateral agreements.
• The bilateral agreements should further specify what criteria need to be fulfilled for a ‘nexus’ to a given country to exist (where a nexus is what links the traveller to an EU Member State or the US). Considering the principle of proportionality, this nexus should be defined, concrete and verifiable.
• Competent authorities should be required to establish an objective link between the risk to public security or public order and the individual concerned on a case-by-case basis. Requesting competent authorities should, as a rule, indicate the specific reasons for believing that an individual may pose a risk or, at least, the nature of the identified risk.
• Competent authorities that share data should be informed of the onward sharing of that data in an effective manner.

Read more here