Latest / IMI Podcasts / Europe Built GDPR, Then Gave Your Data to Trump
Transcript
- 0:00SPEAKER_00: The European Union builds the world's strictest privacy law.
- 0:03SPEAKER_00: Now Brussels is negotiating how much of your personal data to hand over to American border agents.
- 0:09SPEAKER_00: Under a proposed agreement, US authorities would gain access to the fingerprints, facial scans, and sensitive personal data of EU citizens.
- 0:18SPEAKER_00: The alternative?
- 0:19SPEAKER_00: Lose visa-free travel to America entirely.
- 0:22SPEAKER_00: Here's what's on the table: who it affects, and what it means for you.
- 0:26SPEAKER_00: Brussels is preparing to negotiate a data sharing agreement with the United States called the Enhanced Border Security Partnership, or EBSP.
- 0:35SPEAKER_00: Under it, each EU member state would sign a bilateral deal with the US Department of Homeland Security, opening national biometric databases to American border officials.
- 0:45SPEAKER_00: EU ministers approved a mandate to begin negotiations in December 2025.
- 0:51SPEAKER_00: No government raised a fundamental objection with the accordance, so the Council adopted the decision without debate.
- 0:57SPEAKER_00: So, what data are we talking about?
- 1:00SPEAKER_00: Fingerprints and facial scans are at the core.
- 1:03SPEAKER_00: But the draft also covers data revealing ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, and details about a person's health or sex life.
- 1:15SPEAKER_00: The caveat is that transfers of such information must be strictly necessary and proportionate, but the precise thresholds for what qualifies as strictly necessary and proportionate have not yet been defined.
- 1:28SPEAKER_00: Basic identity information tied to travel documents would be shared automatically.
- 1:33SPEAKER_00: The more sensitive categories would require additional justification, though those boundaries are exactly what the negotiation is supposed to determine.
- 1:41SPEAKER_00: We'll tell you in a minute what may be even more frightening than this information exchange.
- 1:45SPEAKER_00: That's how they'll obtain the information.
- 1:48SPEAKER_00: The ultimatum.
- 1:49SPEAKER_00: But first, Washington has set a deadline of December 31, 2026 for those agreements to be operational.
- 1:56SPEAKER_00: After that date, the Department of Homeland Security will assess each country's compliance during visa waiver program reviews.
- 2:03SPEAKER_00: Countries that fail to meet U.S.
- 2:05SPEAKER_00: expectations risk suspension from the program, which would reimpose visa requirements on their citizens.
- 2:11SPEAKER_00: Apart from Bulgaria, Romania, and Cyprus, 24 EU member states currently participate in the visa waiver program.
- 2:20SPEAKER_00: The implication is straightforward.
- 2:21SPEAKER_00: Share the data with us or tell your citizens they need visas to visit America.
- 2:27SPEAKER_00: The European Commission is pushing for a single EU-wide framework, rather than leaving each capital to negotiate a loan with DHS.
- 2:35SPEAKER_00: According to the Commission's proposal, the agreement would set out the legal structure and conditions for the exchange of information between the competent authorities of the EU member states and of the US.
- 2:47SPEAKER_00: Now, there's a related concern buried in the draft about automated decision making.
- 2:52SPEAKER_00: As currently written, the text does not explicitly prohibit US authorities from using algorithms to assess EU travelers.
- 3:00SPEAKER_00: Decisions with significant negative consequences may not be made solely by automated systems unless U.S.
- 3:07SPEAKER_00: domestic law authorizes such procedures.
- 3:10SPEAKER_00: Appropriate safeguards would apply, including the right to request human review.
- 3:14SPEAKER_00: Whether any of this is compatible with the General Data Protection Regulator, the GDPR, which restricts automated decision making and applies outside EU borders, is a question the draft does not resolve.
- 3:28SPEAKER_00: Europe's data protection watchdog has weighed in.
- 3:31SPEAKER_00: In a September 2025 opinion, European data protection supervisor Wojciech Vivianowski described it as the first EU agreement involving large-scale sharing of personal data, including biometrics, with a third country.
- 3:45SPEAKER_00: He stressed that the processing must not exceed what it is.
- 3:48SPEAKER_00: Again, strictly necessary and proportionate.
- 3:51SPEAKER_00: Whether that standard can survive negotiations with an administration that is simultaneously proposed requiring five years of social media history from all visa waiver program travellers is another question entirely.
- 4:05SPEAKER_00: So the question many Europeans will ask is what's happening and who's leading the movement to counteract this proposal?
- 4:12SPEAKER_00: Well, public and political pushback has been limited so far.
- 4:16SPEAKER_00: Renew Europe MEP Raquel Garcia Hamida van der Waal has submitted written questions to the Commission and EU capitals, demanding to know why negotiations were opened during heightened transatlantic tension.
- 4:30SPEAKER_00: But according to reporting by StateWatch, not a single EU member state raised a fundamental objection, though several flagged concerns about timing, legal basis, and data protection.
- 4:41SPEAKER_00: IMI pro David Lesperance urged perspective on the timeline.
- 4:46SPEAKER_00: It must be emphasized that this is a draft agreement in its earliest stage, he told IMI.
- 4:51SPEAKER_00: There are a significant number of legal issues that must be dealt with, such as the GDPR, along with practical implementation issues.
- 4:59SPEAKER_00: Lesperance pointed to prior border enforcement initiatives as a reference.
- 5:04SPEAKER_00: If one looks back at prior similar efforts, such as the Western Hemisphere Travel Initiative, such programs take years to negotiate and then implement, he said.
- 5:14SPEAKER_00: That initiative mandated by Congress in 2004, after the September 11th attacks, took five years to roll out fully, with its final phase reaching land and sea borders only in June 2009.
- 5:27SPEAKER_00: The EBSP does not exist in isolation.
- 5:30SPEAKER_00: It's one of several concurrent US moves expanding personal data collected from international travelers.
- 5:36SPEAKER_00: Under the proposed overhaul of the Electronic System for Travel Authorization, or ESTA, social media disclosure would become mandatory, with more fields covering biometric data, family members' contact histories, and email addresses spanning 10 years.
- 5:53SPEAKER_00: Several EU member states, including Ireland, the Netherlands, Denmark, Germany, and Finland, have already issued travel advisories concerning the United States.
- 6:02SPEAKER_00: On its own side of the ocean, the EU is building parallel biometric border infrastructure.
- 6:08SPEAKER_00: Its entry-exit system, or EES, captures fingerprints and facial scans from non-EU travelers at Schengen borders.
- 6:16SPEAKER_00: The pre-travel screening system, called ETIAS, is expected to follow in late 2026, which we covered in the video that will pop up on your screen in a few seconds.
- 6:26SPEAKER_00: Both sides of the Atlantic are assembling ever larger databases of traveler data.
- 6:30SPEAKER_00: The EBSP would connect some of them.
- 6:33SPEAKER_00: If you're thinking about how to structure your international life, residency, and travel, these developments are worth watching closely.
- 6:40SPEAKER_00: The rules that govern your ability to cross borders are changing on both sides of the ocean.
- 6:45SPEAKER_00: Now, if you want to learn about the program that potentially triggered this proposal by the United States, watch this next video on your screen now, all about the ETIS system that's poised to become the algorithmic final say in visa-free travel.
- 6:59SPEAKER_00: Check it out on your screen now.