Sharing of personal data with the United States must be accompanied by comprehensive and effective safeguards

On 17 September 2025, the European Data Protection Supervisor (EDPS) issued an Opinion on the negotiating mandate for a framework agreement between the European Union and the United States of America on the exchange of information for security screenings and identity verifications.

The aim of the Recommendation adopted by the European Commission, is to set out the legal structure and conditions for sharing of information between the competent authorities of the EU Member States and the United States. On this basis, individual Member States would be empowered to sign bilateral agreements for exchange of data from their national systems. This is linked to the requirement by the United States for admission to, and further participation in, the U.S. Visa Waiver Program, pursuant to which the partner countries have to conclude an ‘Enhanced Border Security Partnership’ with the U.S. Department of Homeland Security.

Wojciech Wiewiórowski, EDPS, said: “While border security is a legitimate aim, the seriousness of the interference with the fundamental rights to data protection and privacy, resulting from the proposed sharing of personal data with a third country for the purposes of border and immigration control, should be considered as comparable to the interference caused by the exchanges of data for law enforcement purposes. Therefore, it is of utmost importance to provide comprehensive and effective safeguards with regard to the protection of personal data and other fundamental rights and freedoms of the concerned individuals, regardless of their nationality and place of residence.”

The EDPS notes that the proposed framework agreement, once finalised, would establish an important precedent, as it would be the first agreement concluded by the EU to entail large-scale sharing of personal data, including biometric data (fingerprints), for the purpose of border and immigration control by a third country. Therefore, the EDPS stresses the need to ensure that the envisaged processing of personal data does not exceed the limits of what is strictly necessary and proportionate.

To this end, the EDPS makes a number of specific recommendations aimed at defining the personal and the material scope of the envisaged data sharing as narrowly as possible. Moreover, taking into account the specific prohibitions on certain data transfers laid down in EU law, any direct or indirect sharing and transfer of data from the EU large-scale IT systems in the area of justice and home affairs and in particular from those related to migration and asylum, must be strictly excluded.   

Finally, the EDPS makes other important recommendations, including the accountability mechanisms, in particular the need for clear and specific justification of each query; the transparency of the envisaged processing and the corresponding information obligations of the competent U.S. and EU authorities; and the availability of judicial redress in the United States regardless of the citizenship.