Your fingerprints already cross the Atlantic every time you fly to the US
Digital rights group EDRi warns that a new EU-US pact, the Enhanced Border Security Partnership, will hand Washington direct access to Europeans' biometric profiles in exchange for keeping visa-free travel. What the warning leaves out: anyone who has ever landed at a US airport already had their fingerprints and photo taken and checked against a federal database, deal or no deal.
The push didn't start with Brussels selling anyone out. In 2022 the US told visa-waiver countries to hand over biometric databases or lose the exemption; the EU Council only authorized negotiations in December 2025, and a draft text leaked in May 2026.
A Mozilla engineer who volunteers on a data-rights project pressed a sharper question in the thread: does the deal cover only people applying for US travel authorization, or the EU's entire biometric archive?
How a 2022 US ultimatum became the EBSP framework
EDRi's report describes a framework agreement, the Enhanced Border Security Partnership (EBSP), that would let the US and EU member states automatically exchange biometric data and traveler risk profiles. The trigger goes back to 2022, when Washington announced that countries wanting to keep their citizens' visa-free access to the US would need to open their biometric databases to US border authorities. The Council of the EU authorized the European Commission to negotiate in December 2025; a draft of the text leaked via Statewatch in May 2026, and individual member states are expected to sign their own bilateral versions once the framework is settled.
EDRi's objection isn't to data sharing in the abstract. It argues the leaked text tracks the US negotiating position "almost entirely," departing from the mandate EU governments actually gave their negotiators, and that it would let Washington request not just fingerprints and photos but "highly sensitive and subjective 'indications of risk'": profiling that, EDRi warns, could flag travelers based on political opinion with no defined standard for what counts as risky. The group says this breaches the EU's own Charter of Fundamental Rights and Court of Justice case law on international data transfers, and it is asking the Commission and Council to refuse the deal outright rather than negotiate around it.
The thread: "nobody has sold anybody out yet"
In the discussion, several commenters pushed back on the framing before the policy substance came up at all. One reader pointed HN back to a line already sitting in the piece it was busy arguing with:
"In 2022, the US government announced that it would require access to biometric databases of countries if they wish to keep visa exemption for their citizens travelling to the US" — a commenter quoting the article's own timeline
His own comment ended, sarcastically: "Big bad eu !!11!?!" The correction matters less for effect than for accuracy: EDRi's own reporting places the US, not the European Commission, as the party that set the terms first.
'I don't see the issue': an assessment from someone whose job is exactly this
Not every skeptic was dismissing privacy concerns outright. One of the more grounded responses came from a Netherlands-based researcher:
"Under the assumption that this framework is somewhat sane and only shares biometric data of those people who actually request an ESTA, I don't see the issue. This data already leaks whenever you travel legally to the US, because they take it from you as a requirement of entry" — a cybersecurity researcher at Dutch research institute TNO
A Mozilla engineer who volunteers on the Solid data-rights project asked the question EDRi's piece doesn't fully answer:
"It's not clear to me if this would allow access to all biometric data, or 'just' to that of people crossing the US border" — Vinnl, a Mozilla engineer and Solid project volunteer
That scope question, whether the pipe carries only ESTA applicants' data or something broader, is exactly what a leaked framework text can't yet resolve.
The privacy guarantee that doesn't survive contact with how borders work
The sharpest technical objection came from a reader picking apart the "data only moves when you travel" premise:
"My country doesn't know if I travel and where. So the supposed privacy guarantees are empty claims ... as soon as they get access to that DB, they will start working on scraping all data from it" — a commenter who mapped the deal's actual data flow step by step
If the safeguard is "we'll only ever query records for people actually crossing the border," that promise depends entirely on the querying side's restraint, not on anything built into the data architecture itself. Whichever version of the EBSP individual member states eventually sign, that's the clause worth reading twice.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
An ER physician had a top insurance plan. It still failed her husband
Randy, an entrepreneur with no history of mental illness, was recommended eight weeks of inpatient psychiatric care after a suicidal crisis — the treating psychiatrist rated him very high risk. Six days in, the family's insurer denied further coverage, and a day later the facility discharged him. He spent his final months cycling through outpatient programs, ER visits, and brief readmissions.