EU–US: the Commission’s proposal for a framework agreement on border security

Brussels – Ensuring that European citizens can travel more easily to the United States, but above all that their personal data is protected. These are the objectives for which the European Commission today (10 September) follows up on the mandate to negotiate an EU-US framework agreement on the Enhanced Border Security Partnership (EBSP). The latter is one of the requirements set by Washington for a country to be able to participate on a continuous basis in the Visa Waiver Programme. This scheme allows citizens of participating countries to travel to the US without a visa for a maximum of 90 days, but only for tourism or business purposes.

The EU Commission today presented the proposals for Council decisionsrelating to signing and conclusion of the EBSP. The proposed text will set out the general conditions for the reciprocal exchange of information between the two parties. In particular, “any actual exchange of information with the United States will be based on bilateral agreements which Member States will conclude with the United States.” It also stipulates that “the data exchanged will be drawn from the national databases” of EU countries, ensuring “robust data protection safeguards”—in line with EU law and Charter of Fundamental Rights of the European Union.

The proposal also lays down rules for the automated exchange of personal data “necessary for the identification of the individual during the assessment of an application for travel authorisation or a visa, or during a border check.” The text specifies that if, during the assessment, there are “reasons to believe that an individual’s entry or stay may pose a serious and genuine risk to public security or public order,” a query may be made regarding that person.

With regard to the section on the protection of personal data, the principle of “purpose limitation” applies, that is to say, identity verification, as well as the screening and assessment of individuals, may only be carried out if necessary to determine that the entry or stay of travellers “would pose a serious and genuine risk to public security or public order.” The proposal also ensures that “personal data will be retained only for as long as is necessary and appropriate, taking into account specific factors listed in the framework agreement and subject to a review, at least annually, of the retention period.” Provision is also made for “safeguards for the processing of special categories of data” and obligations regarding “transparency and information concerning the rights of data subjects to access and rectify their data.” It is also emphasised that both “parties are required to establish effective administrative and judicial remedies to protect data subjects, as well as independent oversight mechanisms.”

In December 2025, the Council had instructed the Commission to open negotiations with the US, which began in January this year. It is now up to the Council to decide on the signing of the framework agreement and subsequently submit it to the European Parliament for approval. Once the European Parliament has given its consent, the Council will be able to proceed with the formal conclusion of the agreement. Once the EU–US framework agreement enters into force, Member States will be able to conclude bilateral agreements with the United States, in accordance with the conditions and safeguards set out in the framework agreement.

In 2022, the United States of America (USA) introduced a new requirement for all countries admitted to, or seeking admission to, the US Visa Waiver Programme (VWP), which requires the conclusion of an EBSP with the US Department of Homeland Security (DHS) as a condition for admission to the VWP and continued participation in the scheme. These partnerships aim to establish bilateral information exchanges to enable the authorities to verify the identity of travellers from partner countries effectively and to determine whether they pose a threat to US security. The EBSP agreements are due to be concluded by 31 December 2026.