The United States has given the European Union a deadline of 31 December 2026 to grant American authorities access to sensitive national police databases, or face the suspension of visa-free travel to the US for citizens of EU member states.
The demand is framed under a programme called the Enhanced Border Security Partnership (EBSP), a new condition attached to continued participation in the US Visa Waiver Programme (VWP). The Trump administration is pressing all 41 countries currently enrolled in the VWP to conclude EBSP agreements by the year-end deadline, with the EU negotiating as a single bloc through the European Commission.
Twenty-four EU member states currently participate in the VWP, which allows their citizens to travel to the US for up to 90 days without a visa through the Electronic System for Travel Authorization (ESTA). Bulgaria, Romania, and Cyprus are already excluded. The European Council authorised the Commission to begin negotiations in December 2025, and a draft framework agreement has since been produced and published by civil liberties organisation Statewatch. The Commission’s draft goes beyond what US authorities had originally disclosed, raising alarm among data protection bodies and members of the European Parliament.
What the EBSP Would Require
Under the proposed agreement, US Department of Homeland Security (DHS) officials would gain the ability to query EU member state police databases, with biometric data at the core of the exchange. The Commission’s draft confirms that information sharing would be based on fingerprints and facial images held in national law enforcement records. Where a query produces a match, the requested national authority could be asked to provide all alphanumeric and contextual data available on that individual.
The draft also permits, under certain conditions, the transfer of sensitive personal data categories including information on racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, and details relating to health or sexual life. EU police databases contain records on people suspected of crimes but never convicted, meaning US authorities could potentially use matched data to deny boarding or entry to travellers who have no criminal record. The European Parliament’s Think Tank briefing of 22 April 2026 confirmed the Commission is negotiating a framework that would apply to all EU countries except Ireland, which is outside the Schengen zone, and Denmark, which holds an opt-out.
Pushback from Legislators and Data Watchdogs
The European Data Protection Supervisor (EDPS) has described the EBSP as the first agreement of its kind to permit large-scale sharing of personal data for border and immigration control purposes with a non-EU country. In March 2026, the Chair of the European Data Protection Board (EDPB) wrote to the Commission warning that the framework “could significantly impact the protection of fundamental rights, in particular the right to protection of personal data.” Statewatch has stated that the Commission’s current proposal “manifestly violates EU law” and warned the data exchanged could be used to prevent or arrest people who have voiced opposition to US policies in Europe.
A group of European Parliament members wrote an open letter to Commission President Ursula von der Leyen and the Commissioner for Internal Affairs and Migration, describing the proposed database access as “unprecedented.” Dutch MEP Raquel García Hermida-van der Walle, who has been pushing the Commission to halt the process, called the Trump administration’s demands “a clear case of blackmail.” She has also warned that the new requirements could result in peaceful protesters being denied entry to the US, and has called on the EU to step back from negotiations until the US “takes proper responsibility for basic fundamental rights.”
EU interior and justice ministers are expected to discuss the draft framework at a forthcoming Council meeting. The European Parliament must approve any final agreement before it enters into force, though under current arrangements it is not involved in the active negotiation phase. The final decision on concluding the agreement rests with the 27 member states in the Council of the EU. Whether a deal can be reached before the summer recess and ratified before the 31 December deadline remains uncertain. Separately, a US Customs and Border Protection proposal to require ESTA applicants to disclose five years of social media activity and additional personal information is also under review, though that process appears to be running behind its initial schedule.
