As a Pole I can fly to the United States without a visa. I fill in an ESTA, the online travel permit, pay the fee, and Washington waves me through for 90 days. I always understood the arrangement was a favor with strings, the way any favor between governments is. What I did not understand, until I read Statewatch's analysis of the leaked draft, is that the string Washington now wants to pull runs into the national databases where my fingerprints and my face are stored.
The mechanism has an anodyne name, the Enhanced Border Security Partnership, or EBSP. The pitch is simple: if a country wants to keep its citizens in the US Visa Waiver Program, it has to give US border authorities access to its biometric databases. The demand dates to 2022. Washington is putting the same ask to all 43 Visa Waiver countries, and Australia has already signed. Within the EU, everyone except Bulgaria, Cyprus, and Romania travels to the US visa-free, so nearly the whole bloc is on the hook.
In December 2025 the Council of the EU gave the Commission a mandate to negotiate a framework agreement. It was a deliberately narrow mandate, and it expressly prohibited the exchange of information from EU databases. Then, in May 2026, the civil-liberties group Statewatch leaked a revised draft of the Commission's negotiating text. Its analysis, written by Romain Lanneau, is blunt: the draft goes well past what the Council allowed, and much of it does not comply with EU law, notably the Charter of Fundamental Rights.
Here is what "access" means in practice. The EBSP is built to wire national biometric systems into the US IDENT/HART database, the largest biometric store the US government runs, holding over 270 million identities from more than 40 agencies. As Biometric Update has reported, the matching is high-volume and fully automated, returning results in minutes. It is system-to-system, and it runs both ways.
That matters because of how Europe already does this. Even inside Schengen, member states do not hand each other open database access. Under the Prum framework, as Biometric Update points out, they use a hit/no-hit model: you can ask whether a record exists in another country's system, and if it does, you file a formal request for the details. The EBSP skips that restraint. Per Statewatch's reading of the leaked draft, an automated search returns a match, and the match itself triggers the transfer of further data, "including, where available, photographs," under Article 7. Article 9 lets the requesting authority ask for more, on terms set by bilateral deals between the US and each member state.
The categories in scope are the sensitive ones: fingerprints, photographs, genetic data, and what EU law calls special categories, including political opinions and religious beliefs. Per Statewatch's analysis, Article 6 frames the whole exchange around screening people who might "pose a genuine risk to public security or public order," a standard broad enough that almost any activity a foreign government dislikes could be read into it. And Article 7.2, the anti-discrimination clause, forbids discrimination on grounds of sex, ethnicity, religion, disability, age, or sexual orientation, but leaves out political opinion. EDRi's reading of that gap is direct: sharing US-style risk assessments "could further target opposition to the Trump administration, support to transgender people's rights or protests against the genocide in Gaza expressed (publicly) on social media."
This is where I have to separate two things, because EDRi and Statewatch are advocates and write like advocates. EDRi calls the whole demand "nothing less than blackmail" and urges the EU to "refuse to sell people's personal data." That is framing, and you should read it as framing. But the facts underneath it are not rhetoric. The leaked articles say what they say. The Council mandate said what it prohibited. And the concern that this reaches EU citizens, not just foreign nationals, is grounded in the EU's own documents. Biometric Update, reviewing them, reports that the exchange "may include exchanges on citizens and their family members, as well as permanent residents," where strictly necessary and proportionate for combating serious crime or terrorism and where reciprocity is ensured. One reported figure sticks with me, from the same reporting: Germany alone could be asked to open facial images of roughly 5.5 million people.
The EU's own watchdogs are not reassured either. The European Data Protection Supervisor, in a September 2025 opinion, warned, per Statewatch, that the deal would mean large-scale sharing of biometric data for a third country's border control; EUobserver reported the EDPS calling it "an important precedent." In March 2026 the European Data Protection Board's chair, Anu Talus, wrote to the Commission with her own concerns. The legal problem is old and familiar from the Max Schrems cases that struck down two EU-US data deals: EU law demands an "essentially equivalent" level of protection before personal data can cross a border, and in Statewatch's and EDRi's reading, this draft falls short of it.
None of this means the US case is empty. The Visa Waiver Program has been a security-screening arrangement since it was tightened after the September 11 attacks, and Washington's argument is straightforward: automated biometric matching confirms the person boarding is who the passport says, and keeps known terrorists and serious criminals from traveling to the US visa-free. The purpose is real, and so is the leverage: Washington can revoke the waiver, and for a traveler that is a real cost. The Commission's answer has been a "pragmatic" one, splitting the data question from visa policy to negotiate the exchange on its own track. The UK took a narrower road, running anonymized fingerprint checks with DHS rather than signing an EBSP. No final EU deal exists yet, member states are divided, and the actual text is still not public, which is its own tell.
So here is the thing to do, and it is boring, which is how these fights are usually lost. Any final agreement needs the approval of both the Council and the European Parliament. That is the choke point, and the US deadline of December 31, 2026 means it gets decided within the year. Watch for the text to be published, and watch how your MEP votes when it is. The favor with strings is being renegotiated, and for once the price is written down. Read it before someone signs it for you.
