EU Data Protection Supervisor Criticizes Planned US Police Data Sharing Deal — Cybersecurity

European Data Protection Supervisor Wojciech Wiewiórowski has issued a sharp critique of the proposed framework agreement between the EU and the US, warning against mass transfers of biometric data and vague definitions of public security that could enable political profiling.

The European Data Protection Supervisor (EDPS), Wojciech Wiewiórowski, has strongly criticized a planned framework agreement between the European Union and the United States regarding read-only access to national police databases. In an opinion published on October 27, the supervisory authority demanded clear boundaries for the proposed data exchange and warned against the mass transmission of biometric information.

The US government has made the conclusion of this "Enhanced Border Security Partnership" a new condition for participation in the Visa Waiver Program (VWP). Currently, over 40 countries participate in the VWP, allowing their citizens to enter the US without a visa for up to 90 days under reciprocal terms. Nations that refuse the new partnership risk exclusion from the program. The deadline for the framework agreement is set for the end of 2026, after which individual governments, including Germany's, must finalize specific implementation agreements.

A draft for this sensitive data deal has already been negotiated. On September 10, the European Commission published a version ready for signature, which is now available in German along with its annex. Due to deadlines dictated by the US, a two-track procedure is planned: once signed by EU states and the US government, the agreement will be applied provisionally immediately. Democratic legitimacy through the consent of the European Parliament is intended to be secured later using an identical draft.

The final version of the agreement includes changes compared to earlier drafts. US queries in European databases would be permitted only with alphanumeric personal data or fingerprints, excluding facial images for the initial search. However, the subsequent response sent to US authorities could include biometric photographs. According to the US side, this data access is primarily intended for identity verification and security screening of travelers during border procedures and visa applications.

The agreement allows searches if there is a "reason to believe" that a person's entry or stay poses a "serious and actual threat to public safety or public order." Wiewiórowski insists on a narrow interpretation of these terms, noting that "public order" is not uniformly defined in EU law and could encompass both criminal offenses and minor regulatory violations. The broad formulation of purposes in the current draft also grants the US access for investigating serious crime and terrorist offenses.

Critics warn that this framework could facilitate the investigation of left-wing movements in Germany. Last year, the US President and his administration classified the German "Antifa Ost" and its alleged members or supporters as a "Foreign Terrorist Organization," driving the global pursuit of left-wing groups. The EDPS highlights that the inclusion of "trend analyses" of suspicious activities could lead to dragnet investigations based on behavioral patterns, resulting in profiling and unjustified unequal treatment.

For the first automated matching process involving fingerprint transmission, the EDPS demands greater transparency, requiring requesting authorities to specify the basis of their suspicion. Furthermore, access should be restricted exclusively to national databases of individual states. These databases often contain data from major EU platforms such as the Schengen Information System (SIS), the Visa Information System (VIS), or the European Travel Information and Authorization System (ETIAS). Wiewiórowski insists that indirect transfers of this data from EU systems to US authorities must be excluded.

A significant weakness identified by the EDPS, previously noted by privacy activist Max Schrems, concerns independent oversight. While the draft framework provides for mutual designation of independent supervisory bodies, it remains unclear which US agencies would fulfill this role, as the US lacks independent bodies comparable to those in the EU. The European Commission appears satisfied with internal units within US immigration authorities.

Wiewiórowski also emphasized that the mere presence of data in a European police database should not serve as grounds for further action, as these files often contain records of witnesses and victims alongside suspects. This applies to Germany's Police Information System (INPOL), which is managed by the Federal Criminal Police Office for all federal states and is likely to be opened under the German-American implementation agreement.

Regarding the bilateral implementation agreement, the German Federal Ministry of the Interior is responsible. Under pressure to conclude negotiations this year, the ministry led by Alexander Dobrindt (CSU) declined to comment on its preparations, responding only that the government is taking all necessary steps. The Foreign Office, led by Johann Wadephul (CDU), refused to answer substantive questions. Additionally, a parliamentary inquiry by MP Clara Bünger (The Left) was left unanswered, citing the "core area of executive responsibility."

Sources: netzpolitik.org.