Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
The European Data Protection Supervisor has warned again that sharing border and visa data with the United States must come with safeguards that work in practice, not just on paper. In Opinion 27/2026, dated October 27, 2026, the EDPS commented on the Commission’s proposals for signing and provisionally applying a framework agreement between the EU and the US on the reciprocal exchange of information for identity verification, screening and vetting in border procedures and visa applications.
“If the EU and the U.S. agree to exchange personal data,” Supervisor Wojciech Wiewiórowski said, “all the necessary safeguards must be in place to ensure the protection of individuals, including real oversight on both sides of the Atlantic.” The agreement matters well beyond border agencies. It would be the first EU agreement to involve large-scale sharing of personal data, including fingerprints, with a third country for border and immigration control.
Where the agreement comes from
The framework is driven by a US requirement. To join or stay in the US Visa Waiver Program, partner countries must conclude an Enhanced Border Security Partnership with the US Department of Homeland Security. Those partnerships involve letting US authorities query national databases to verify the identity of travelers and screen them.
Rather than have each member state negotiate alone, the Commission proposed an EU framework agreement setting the legal structure and conditions. Member states would then sign bilateral arrangements under it for exchanges from their national systems. The Commission sought a negotiating mandate in July 2025, and the EDPS gave its first opinion on that mandate in September 2025. Opinion 27/2026 addresses the next stage: the decisions to sign the agreement and apply it provisionally.
We first covered these plans in our report that the EU was poised to share biometric data with the US.
What the EDPS said in 2025
The EDPS’s September 2025 position sets the baseline. In its press release on the negotiating mandate, it said the interference with privacy from sharing data for border and immigration control should be treated as comparable to sharing for law enforcement. It called for:
- Defining the people and data covered as narrowly as possible.
- Strictly excluding any direct or indirect sharing from EU large-scale IT systems in justice and home affairs, in particular those on migration and asylum.
- A clear and specific justification for each query.
- Transparency and information obligations for both US and EU authorities.
- Judicial redress in the United States regardless of citizenship.
What the new opinion adds
The full text of Opinion 27/2026 was not accessible to us at the time of writing, so the points below come from the EDPS announcement and published summaries of the opinion. They should be read against the opinion itself.
The EDPS recommends that the agreement set up a secure system for transferring data and clarify the purposes for which data is collected and shared. Summaries of the opinion say it also stresses that processing must be narrowly defined, necessary and proportionate; that systematic screening should be avoided; that each query should be justified and logged; that EU justice and home affairs systems stay excluded; that member states keep the right to refuse requests; and that independent oversight and effective administrative and judicial redress be available regardless of nationality.
The opinion’s focus on provisional application is significant. Provisional application lets parts of an agreement take effect before ratification is complete. If safeguards are weak at that stage, data can flow for months or years before Parliament and national authorities have fully reviewed the deal.
Why oversight on the US side is the hard part
Wiewiórowski’s phrase “real oversight on both sides of the Atlantic” points to a familiar problem. EU transfers to the US have been struck down twice by the Court of Justice, in the Schrems I and Schrems II cases, largely over US surveillance and the lack of effective redress. The current EU-US Data Privacy Framework answered that with a redress mechanism, including a Data Protection Review Court, but it covers commercial transfers. A border agreement involves DHS and law enforcement uses, where the redress questions are different and older US statutes, such as the Judicial Redress Act, apply only in limited ways.
The EDPS’s demand for redress “regardless of citizenship” is therefore not a formality. EU residents who are not EU citizens, and non-EU travelers whose data sits in member state systems, need a route to challenge how US authorities use their data.
What this means for businesses
The agreement governs exchanges between public authorities, not companies. But it affects businesses in three ways.
- Travel and hospitality data. Airlines, travel platforms and employers who move staff across the Atlantic already handle data that ends up in border systems. Our piece on airline data and DHS showed how commercial data reaches the same agencies.
- Transfer risk assessments. How regulators judge US government access shapes every transfer impact assessment. A border agreement with strong safeguards supports the view that US access is controlled; a weak one gives critics material.
- Political risk to the wider framework. Transatlantic data relations are already strained, as we noted in the EU’s tougher tech enforcement plans. Disputes over border data can spill into commercial transfer debates.
A short checklist for privacy teams
- Confirm which transfer mechanisms you rely on for US data flows and when they were last reviewed. Our guides to cross-border data transfers and appropriate GDPR safeguards cover the options.
- Note in your transfer assessments that government access to travel and identity data may change if the agreement is applied.
- If you are an EU institution or body, remember that the EDPS supervises you directly, under the rules discussed in our piece on EDPS Article 42 consultations.
- Track the Council decisions on signing and provisional application, and Parliament’s consent vote.
Captain Compliance helps teams document transfers and assess third-country risk. Those records support a transfer decision; they do not settle whether a given transfer is lawful.
Frequently asked questions
Is the EU-US border data agreement in force?
Not yet. The EDPS opinion concerns the proposals to sign it and apply it provisionally. Council and Parliament steps are still ahead.
Is the EDPS opinion binding?
No. The Commission must consult the EDPS on proposals like this, but the opinion is advisory. It carries weight with Parliament and in any later court challenge.
Will fingerprints be shared?
The EDPS has described the framework as involving large-scale sharing of personal data including biometric data such as fingerprints. The exact scope depends on the final agreement and on each member state’s bilateral arrangement.
Does this affect the EU-US Data Privacy Framework?
Not directly. The DPF covers commercial transfers. But both depend on how the EU judges US government access and redress, so the debates are linked.
The Visa Waiver Program gives Washington considerable leverage: travelers want visa-free entry, and member states want to keep it. The EDPS cannot block the agreement. What it can do is put a list of safeguards on the record before provisional application begins. If those safeguards are missing from the final text, this opinion is likely to be cited in the court case that follows.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
