Help us make the FRA website better for you!

Take part in a one-to-one session and help us improve the FRA website. It will take about 30 minutes of your time.

YES, I AM INTERESTED NO, I AM NOT INTERESTED

AdobeStock/Montri
8
October
2025

Entry/Exit System: Fundamental rights guidance for managers

The Entry/Exit System (EES), launching in 2025, will register non-EU nationals crossing the EU’s external borders. This FRA guidance supports managers overseeing the operation of the new system. It helps them to ensure compliance with EU fundamental rights. It outlines operational considerations: clear communication, dignified biometric data collection and data protection. It also addresses staff training needs. Based on fieldwork at 10 border crossing points in 6 Member States, the guidance will ensure rights are respected under the new system. A separate guidance publication for border guards accompanies this publication.

The EES processes personal data, including biometric data, namely fingerprints and facial images. Biometric data are sensitive personal data, as they allow for unique identification or authentication of a natural person. The central storing of data of hundreds of millions of people bears fundamental rights risks, which must be mitigated by effective data protection safeguards.

The following findings were achieved through qualitative research.

  • The field research at BCPs suggests that, in general, privacy is better protected at air borders, with some exceptions during busy travel periods.
  • The interoperability of the EU IT systems amplifies the risks related to data protection, according to experts in Germany, France and Italy.
  • In Bulgaria and Poland data protection experts and academics noted that gaps in administrative capacity and operating procedures, along with limited oversight, may lead to unlawful access to EES data, creating risks of data protection violations.
  • An academic in Bulgaria identified risks to the right of good administration and the right to an effective remedy, as non-EU nationals might face challenges in accessing their own data stored in the EES or having incorrect data corrected or deleted.

The border guards survey revealed the following findings.

  • 87 % of border guards consider the availability of a comfortable setting that ensures privacy to be an important safeguard for data quality (n = 176) [3] n’ denotes the number of border guards who responded to the specific question across all nine border crossing points in which the fieldwork was carried out, out of a total of 177 participants to the survey. The total number of respondents for each question takes into account both respondents who gave substantial answers to the questions and those who selected the answer options ‘I do not know’ or ‘I prefer not to say’. It does not take into account questionnaire responses in which no answer option was selected.


     
    .

Article 16 of the EES Regulation lists the personal data that the EES processes. Article 39 gives guidance on how to process personal data in the EES lawfully.

More generally, Article 49 of the EES Regulation specifies that EU data protection law, particularly the GDPR and Directive (EU) 2016/680, applies to Member States’ processing of personal data in the EES. Under Article 5 of the GDPR, personal data must be processed lawfully, fairly and in a transparent manner. The processing of biometric data is subject to the limitation and safeguards in Article 9 of the GDPR.

Article 52 of the EES Regulation describes data protection rights, such as the right to access stored personal data, or the right to ask that data be rectified or deleted. In accordance with Article 50(1)(l), all individuals must be informed of their right to lodge a complaint with the relevant supervisory authority if they believe their data protection rights have been violated (for information provision see Section 1).

The following guidance may help national authorities to process personal data in the EES in line with EU data protection law.

  • Guidance 3.1: Conducting a data protection impact assessment before operating new EES components, involving national data protection authorities, as appropriate.
  • Guidance 3.2: Ensuring the security and regular maintenance of hardware and software developed and deployed at the national level through continuous technical optimisation, proactive safeguards and system checks.
  • Guidance 3.1: Taking multi-layered cybersecurity measures to protect personal data against unauthorised access, hacking or misuse.

The following guidance may also fall into the remit of senior officers at BCPs.

  • Guidance 3.4: Offering support and guidance to BCPs on how to provide an environment that ensures confidentiality and privacy when collecting personal data from non-EU nationals.
  • Guidance 3.5: Supporting BCPs to install privacy screen protectors on self-service systems and protective foil to screens or border control booth windows, as appropriate.
  • Guidance 3.6: Raising awareness on the consequences for data entry mistakes and the particularly severe impact they can have on the person concerned.
  • Guidance 3.7: Offering training and guidance to front-line officers on data corrections to be made at first line (e.g. errors at self-registration) and cases to refer to second line (e.g. miscalculation of days of stay), based on agreed data correction policies.
  • Guidance 3.8: Offering training and guidance to officers on how to effectively inform non-EU nationals who request the rectification, completion or erasure of their data about the competent authority to contact and how to proceed with their request.