CDT Europe: the EU-US border data deal bypasses fundamental-rights protections

CDT Europe, with 29 other civil-society organisations and academics, has sent an open letter to the Council of the EU warning that the Enhanced Border Security Partnership (EBSP) would mandate “continuous, systematic transfers of European biometric and genetic data to U.S. databases” — fingerprints, photographs, and genetic information drawn from member-state systems for border and immigration control.

The leverage is explicit. The European Commission is racing a December 31, 2026 deadline, and U.S. negotiators have signalled that non-compliance means revoking the Visa Waiver Program. CDT flags three divergences from established EU standards: automated profiling that can drive “significant adverse actions” with human review only on appeal (high-risk under the AI Act), a purpose-limitation failure that lets data be reused for loosely defined “compatible purposes,” and redress options governed by U.S. law that largely excludes non-citizens.

For the identity beat this is the shape of the thing to watch — biometric interoperability negotiated not on privacy terms but as the price of visa-free travel, on a hard clock. National fingerprint and DNA holdings are exactly the datasets that become impossible to un-share once the pipes are built, which is why the December deadline is worth tracking well before it lands.