The Department of Homeland Security and the European Union are in formal negotiations over an arrangement that would give DHS direct query access to biometric records held by EU member states, a level of access that Brussels has never granted to a non-EU country for border security purposes.

The deal sits inside DHS's Enhanced Border Security Partnership program, which effectively tells Visa Waiver Program countries to open their biometric databases or risk losing visa-free travel privileges. Washington has set a December 31, 2026, deadline for EBSP agreements to be operational. After that, DHS reviews each country's compliance. Countries that fail to meet expectations risk suspension from the VWP, which would reimpose visa requirements on their citizens.

When DHS encounters a traveler, asylum seeker, visa applicant, or anyone flagged during immigration processing, it would query a participating country's database using that person's biometrics.

A match returns fingerprints and related identity data to DHS.

If there's no match, there's no data transfer. That sounds targeted until you consider the volume. Twenty-four of the EU's twenty-seven member states participate in the VWP. DHS wants query access to all of them.

What makes this negotiation unusual is its layered structure. The EU Council authorized negotiation of an EU-level framework agreement in December 2025, setting the legal conditions for data transfers. Individual member states would then sign their own implementing arrangements with DHS, identifying which databases are involved and setting operational terms. The framework creates the legal permission. The bilateral deals create the pipeline.

The scope of data under discussion extends well beyond fingerprints and passport photos. Draft documents show that European countries may be compelled to transfer "special categories" of personal data to US border authorities, including political opinions, trade union memberships, and information on sex life.

The draft allows this if transfers are "strictly necessary and proportionate," and the DHS gets to argue what qualifies. The European Data Protection Supervisor described it as the first EU agreement involving large-scale sharing of personal data, including biometrics, with a third country.

European negotiators are pushing for limits on bulk data harvesting, meaningful human oversight when automated decisions produce adverse outcomes, tight controls on what happens to data after DHS receives it (particularly transfers onward to third countries), and some form of legal remedy for Europeans whose data gets misused.

The EU also wants reciprocity, meaning European authorities would get to query American databases rather than just supplying data in one direction. That last demand tells you something about the power dynamics here. The current proposal asks Europe to feed information into a system it can't search itself.