A deadline drives the terms
On August 24, 2026, Statewatch published a second leaked draft — dated June 23, 2026 — of the framework agreement for an "Enhanced Border Security Partnership" (EBSP) between the EU and the United States. The document lays the ground rules under which individual member states would sign bilateral deals granting US border and immigration agencies automated query access to European police and immigration databases: fingerprint-based hits returning criminal convictions, security records, immigration history, and photographs. The European Commission has been negotiating this framework since the Council authorized the mandate on December 16, 2025, following a July 23, 2025 Commission proposal (EUR-Lex CELEX:52025PC0447).
The leverage behind the talks is not subtle. Washington has told Visa Waiver Program (VWP) members — nearly every EU state — that continued visa-free travel to the US is conditional on signing a bilateral EBSP deal by December 31, 2026. Miss the deadline, and a country's citizens lose ESTA eligibility and fall back to interview-based B1/B2 visas. That is a genuine, immediate cost for millions of travelers, and it is why the Commission is negotiating a common framework at all: better one EU-wide floor than 27 member states cutting inconsistent bilateral deals under the same ultimatum.
The case for a deal — stated fairly
The underlying security rationale is not fabricated. Coordinated identity and criminal-history checks at the border can catch people traveling on stolen or fraudulent documents, flag genuine security risks before they board a flight, and close gaps that ad hoc, slower channels like mutual legal assistance treaties leave open. The US is not alone in wanting this: EU states already share biometric and criminal-record data with each other through Prüm and with the US through existing PNR and law-enforcement arrangements. An EBSP that were narrowly scoped, judicially reviewable, and time-limited in retention would be a defensible modernization of that existing architecture, not a radical departure from it.
Where the June draft still falls short
The second draft does move on paper. Statewatch's analysis notes it narrows the data-exchange trigger to a "serious and genuine risk to public security and public order,� swaps vague "periodic" retention reviews for an explicit annual cycle, and tries to exclude EU-wide systems by referring only to "national information systems." These are not nothing.
But on the two issues that matter most, the draft is essentially unchanged from the first leak in May 2026. First, US negotiators continue to resist a categorical carve-out for special-category data — race, ethnicity, political opinion, religion, sexual orientation. Statewatch quotes the US position directly: such information "may indirectly be revealed as part of the information exchanged and should therefore not be categorically excluded." That is a request to process GDPR Article 9 data by default, with exclusion left to case-by-case discretion rather than a binding rule.
Second, the oversight model has not changed. As Austrian privacy campaigner Max Schrems — who brought down both Safe Harbor (2015) and Privacy Shield (2020) at the Court of Justice of the EU on exactly this ground — has argued of the EBSP, US oversight would run through internal agency inspectors general rather than a body independent of the executive, which the CJEU has twice held falls short of the EU Charter's Article 47 right to an effective remedy. This is not a fresh critique invented for this leak; it is the identical structural defect that has already unwound two prior EU-US transfer regimes. A framework built to survive should be designed to survive judicial review, not merely political urgency.
The EDPS flagged the stakes as early as September 17, 2025, calling this potentially "the first EU agreement involving large-scale sharing of personal data, including biometrics, with a third country" and insisting that processing stay strictly necessary and proportionate. The Commission's own July 2025 proposal text promises exactly that — barring "routine and systemic query concerning all persons travelling between the EU and the US." The gap between that promise and a June 2026 draft that still won't rule out querying protected-class data is the whole story.
The proportionate path
None of this requires abandoning cooperation on border security. It requires the Commission to hold two lines it has already stated as its own position: a binding, not discretionary, exclusion for special-category data, and independent — not intra-agency — redress mechanisms on the US side, mirroring the Data Protection Review Court structure used to prop up the EU-US Data Privacy Framework. Absent both, this agreement is heading toward the same fate as its predecessors: signed under deadline pressure, then struck down in Luxembourg once the first individual complaint reaches the CJEU. A framework that collapses in three years serves neither security nor innovation; a narrower one that actually survives judicial review would.