Created under the General Data Protection Regulation (GDPR), the European Data Protection Board (EDPB) is the EU body responsible for ensuring the consistent application of data protection rules across the European Union.
The EDPB brings together the national data protection authorities of EU Member States and regularly intervenes when legislative initiatives or public policies may affect the personal data rights of European citizens.
EDPB Chair Anu Talus recently raised concerns with the European Commission regarding changes being considered by U.S. authorities to the operation of the Electronic System for Travel Authorization (ESTA).
In a letter dated March 10, 2026, addressed to the European commissioners responsible for justice and home affairs, Talus said the Board had taken note of the proposed revision of the ESTA process, which currently allows nationals of the 42 countries participating in the Visa Waiver Program, including most countries in the European Economic Area, to travel to the U.S. for short stays without obtaining a visa.
ESTA: more personal data could be requested from travelers
In its letter, the European body states that the reform under consideration in the United States could lead to the collection or disclosure of a significant amount of personal data concerning European travelers.
Among the information that could be requested are details related to applicants’ social media activity over the past five years. The proposal could also involve the collection of certain data about a traveler’s family members, even when that information is not directly related to the planned trip.
The proposal would allow for the collection, and/or require the disclosure, of a significant volume of EEA individuals’ personal data, including information about their social media activity in the last five years, as well as personal data of their family members, which are not related to the ESTA applicant’s travel.
Anu Talus – Chair of the European Data Protection Board (EDPB)
The Board also notes that U.S. authorities are considering making it mandatory to submit ESTA applications through the official mobile application provided by U.S. Customs and Border Protection, which would replace the current option of applying through the website esta.cbp.dhs.gov.
For the European body, these developments raise questions about how the personal data of citizens from the European Economic Area would be collected, used, and stored.
Questions over the exercise of European citizens’ rights
Beyond the nature of the information collected, the European Data Protection Board is also questioning the safeguards that would be available to European travelers to exercise their data protection rights.
The organization believes in particular that the proposed reform could raise important issues for the protection of the fundamental rights of the individuals concerned.
This proposal raises significant concerns for the protection of the fundamental right of data protection of EEA individuals.
Anu Talus – Chair of the European Data Protection Board (EDPB)
In this context, the Board is asking the European Commission to clarify whether it has already taken, or plans to take, any measures in response to these developments.
“The EDPB would be grateful if you could indicate whether the European Commission has taken, or plans to take, any action in this regard,” the organization wrote.
The EDPB also suggests that the EU executive raise questions with U.S. authorities regarding the ability of European citizens to effectively exercise their data protection rights under U.S. law, particularly under the Privacy Act, as well as the retention period for the information collected through the ESTA process.
EU–U.S. border security cooperation in the background
The letter also refers to ongoing discussions between the European Union and the United States on a cooperation framework known as “Enhanced Border Security Partnerships”.
According to the EDPB, these negotiations, as well as any agreements that could be concluded between EU Member States and U.S. authorities, could have important consequences for the protection of personal data.
The framework agreement as well as the individual agreements between the Member States and the USA could significantly impact the protection of fundamental rights, in particular the right to protection of personal data.
Anu Talus – Chair of the European Data Protection Board (EDPB)
In this context, the European Data Protection Board says it stands ready to cooperate with the European Commission’s services in order to provide additional information on these issues.
