Visa-free travel faces privacy concerns

A significant shift is underway in the transatlantic relationship between the United States and the European Union, revolving around an increasingly complex question: who is allowed to access your personal data, and under what conditions.

A proposed framework called the Enhanced Border Security Partnership (EBSP) is at the centre of the debate. Washington wants every partner in the Visa Waiver Program (VWP) to adopt it. If they agree, United States authorities will have access to sensitive data on European travellers, including biometric information stored in national databases across the continent.

Views on this proposal are split into two sides. Supporters call this a necessary evolution in modern border security. Opponents call it a direct test of whether the European Union will truly protect the privacy standards it has spent years fighting to establish.

The trade-off for visa-free travel

For millions of Europeans, the Visa Waiver Program is one of the most tangible benefits of the transatlantic relationship. The programme allows citizens from participating countries to travel to the United States for tourism or business for up to 90 days without applying for a visa.

However, participation in the VWP programme is not unconditional. Countries must meet security and information-sharing standards set by the United States Department of Homeland Security (DHS). In recent years, those requirements have expanded, and the EBSP framework represents the latest evolution of this cooperation.

Under the proposed agreements, EU member states would establish a mechanism allowing United States authorities to request information on travellers to verify identities and conduct security checks.

Washington argues that deeper access to foreign databases enhances the ability to detect terrorists, serious criminals, and immigration violators before travellers board a flight.

What data could be shared?

According to draft discussions and information on the negotiations, the United States is particularly interested in biometric information, including fingerprints and facial scans stored in national databases across Europe.

Biometric data has become central to modern border control systems because it allows authorities to verify identities more reliably than traditional documents.

However, the scope of potential data transfers has raised concerns. Analysts and civil society groups warn that the framework could also allow access to sensitive types of personal data in certain cases. Under European data protection laws, such data could include information revealing political opinions, religious beliefs, health status, genetic data, or other deeply personal attributes.

Supporters of the agreement emphasise that any data transfer must meet strict legal thresholds and safeguards, including the requirement that it be “necessary and proportionate.”

Tight deadlines

Negotiations are proceeding under a rigid deadline.

Washington expects the new EBSP agreements to be in effect by 31 December 2026. After that date, the Department of Homeland Security will assess each country’s compliance as part of its regular reviews of Visa Waiver Program participants.

Countries that do not meet United States expectations risk being suspended from the programme, which could lead to the re-imposition of visa requirements for their citizens when travelling to the United States.

Currently, 24 European Union member states participate in the Visa Waiver Program, while Bulgaria, Romania, and Cyprus remain outside the system.

Privacy concerns in Europe

This proposal has triggered a debate across Europe about how far security cooperation should extend when it involves personal data.

The European Union is widely known for some of the world’s strictest privacy protections under the General Data Protection Regulation (GDPR). Any agreement allowing access to biometric databases or sensitive personal data therefore raises significant legal and political questions.

Digital rights organisations argue that linking visa-free travel to the sharing of biometric data risks normalising cross-border surveillance systems. Biometric identifiers such as fingerprints or facial scans are particularly sensitive because they cannot be easily changed or revoked if compromised.

Others note that the framework agreement itself only establishes the legal structure for data exchange, while the exact scope of access to databases and the types of information remain to be defined in practice.

Security cooperation and data sovereignty

The broader debate reflects tensions that have existed in the transatlantic relationship for decades.

On one side, governments emphasise the importance of intelligence sharing and joint border control in a world where security threats increasingly transcend national borders.

On the other side, privacy advocates warn that expanding data access could erode the protections that European lawmakers have spent years building.

Previous EU-United States data agreements, including those related to airline passenger records, have tested the balance between privacy and security cooperation.

What are the next steps?

Brussels and Washington are still in the early stages. The European Commission has received authorisation from EU member states to open formal negotiations, but any final agreement will require additional approval before it can take effect.

Even then, the path to implementation remains long. Technical systems will need to be built. Legal safeguards will need to be harmonised. In reality, this process will take several years.

But a larger question has been raised — one that policymakers on both sides of the Atlantic cannot avoid: how to preserve the convenience of international travel without abandoning the personal data protections that millions rely on? The EU will need to negotiate firmly to ensure any agreement truly stands up to its own privacy standards.

How that balance is struck will determine whether this becomes a model for transatlantic cooperation or the beginning of a much deeper debate.