A proposed EU-US data exchange proposal aimed at streamlining border procedures and visa applications has come under intense scrutiny for allegedly violating European Union law and exceeding the negotiating mandate granted by the Council of the EU.
- Biometric Scope: The “Enhanced Border Security Partnership” (EBSP) would involve continuous and systematic transfers of fingerprints, photographs, and genetic data.
- US Ultimatum: The United States has requested access to Member State databases by December 31, 2026, threatening to revoke the visa waiver programme for most EU countries if demands are not met.
- Legal Concerns: The proposal allows for automated decision-making and lacks sufficient judicial redress for third-country nationals.
The proposal is the result of secret discussions between the European Commission and the US dating back to 2022. While the Council of the EU granted the Commission a limited mandate for negotiations, it expressly prohibited the exchange of information from EU databases.
Documents reveal that the current proposal ignores these limits and fails to adhere to essential data protection safeguards. This creates a significant legal rift, as the EU views data protection as a fundamental right, while the US generally treats it as a consumer protection issue.
Conflicts in Data Protection Standards
The disparity in legal frameworks has led to previous conflicts, with the Court of Justice of the European Union (CJEU) annulling two prior agreements due to insufficient US safeguards, known as Schrems I and Schrems II.
Current tensions are further exacerbated by US legislative moves, such as the proposed SECURE Data Act, and the weakening of redress mechanisms. Reports indicate the firing of members of the Privacy and Civil Liberties Oversight Board and the purge of various inspectors general and immigration judges in the US.
Furthermore, the Foreign Intelligence Surveillance Act (FISA) Section 702 continues to be a point of contention, granting US intelligence mass surveillance powers without effective redress for non-US nationals.
Risks of Profiling and Automated Decision-Making
The proposal’s scope includes the exchange of information on US nationals, Union citizens, and third-country nationals. However, it omits essential protections for third-country nationals, potentially allowing their data to be exchanged without safeguards.
Critics warn that the agreement uses broad and vague standards, such as “public security or public order,” to justify data processing. This could allow US authorities to profile individuals based on political opinions or protests against US policies.
Article 21 of the agreement allows for automated decision-making, which contradicts a 2022 CJEU ruling that prohibited the use of self-learning AI systems to modify assessment criteria without human review. This is particularly concerning given reports that US Immigration and Customs Enforcement (ICE) has expanded its use of AI to track migrants and dissidents.
Lack of Oversight and Redress
The agreement’s approach to redress is largely aligned with the US view, where remedies are often triggered only after harm has occurred. In contrast, EU law allows individuals to request a review of how their data is managed regardless of whether harm is proven.
Third-country nationals are effectively excluded from comparable remedies, leaving them with little to no protection despite the vast amounts of data stored on them in European databases.
Additionally, the agreement lacks strict requirements for data retention and quality. Competent authorities are not obligated to warn the requesting party if there are significant doubts regarding the integrity of the shared information.
The agreement has been sent to the Council and awaits approval from the European Parliament. It arrives amid a broader push by the Commission to simplify EU data protection regulations, a move that some argue could weaken hard-won privacy protections.
Discover more from Archyworldys
Subscribe to get the latest posts sent to your email.
