EBSP: the EU negotiates an agreement that will give the United States access to European biometric databases in exchange for visa exemption

EDRi warns on July 20, 2026 about the Enhanced Border Security Partnership (EBSP), a framework agreement under negotiation that would allow U.S. border authorities to search national biometric databases of EU member states. A significant political choice, with security blind spots.

The facts

On July 20, 2026, European Digital Rights (EDRi) publishes a critical analysis of the Enhanced Border Security Partnership Framework Agreement (EBSP) currently being negotiated between the European Commission and the United States. The agreement aims to maintain the visa exemption enjoyed by European travelers to the United States - but at the cost of an extended data exchange mechanism.

Timeline confirmed by EDRi:

• 2022: The United States notifies its visa-exempt partners of the future requirement for biometric access.
• December 2025: The Council of the EU officially mandates the Commission to open negotiations.
• May 2026: Statewatch publishes a leak of a revised draft of the text.
• July 20, 2026: EDRi publishes its analysis; no voting date has been set yet.

What the text provides

Two main components, according to the draft analyzed by EDRi:

• Access to biometric databases of Member States to enable traveler screening.
• Sharing of "risk indicators" based on European national databases, with profiling for security purposes.

The American agency that is the recipient is not named in the EDRi note analyzed. The exact scope of the data (fingerprints, facial images, criminal record, passport data) is not publicly itemized at this stage.

EDRi's analysis

Three main criticisms, in the words of the NGO:

1. Potential discrimination: "The draft text does not provide anything to protect against discrimination based on political opinions." EDRi explicitly cites the risks for pro-Gaza activists, LGBTQ+ individuals, and political opponents.
2. Deviation from the mandate: the draft "significantly deviates from the negotiating mandate of the Member States".
3. Insufficient compliance with European data protection law.

EDRi does not propose amendments: the NGO calls for rejection.

The security angle that must be added

EDRi rightly raises the fundamental rights issues. We must add the operational security angle that the text leaves unclear:

• Threat model on the recipient side: what retention, purging, and access logging policy? Pull-mode access to national databases creates a massive exfiltration point if the US infrastructure is compromised (recall the OPM breach of 2015: 21.5 million federal personnel files exfiltrated, including fingerprints of 5.6 million).
• Reciprocity and governance: what are the European audit channels on actual use? On requests?
• Legal anchoring: since the invalidation of the Privacy Shield (Schrems II, CJEU, July 2020), transferring European personal data to the United States requires specific guarantees. The successor (Data Privacy Framework, 2023) hangs by a thread and is the subject of appeals.

To follow

No voting date set. The text remains at the negotiation level. We will need to monitor:

• the publication of a consolidated text,
• the position of the European Data Protection Supervisor (EDPS) and the European Data Protection Board (EDPB),
• the position of the European Parliament (co-legislator for an international agreement).

Primary sources to prioritize: Statewatch (for leaks) and EDRi (edri.org) for civil society analysis.