Help us make the FRA website better for you!
Take part in a one-to-one session and help us improve the FRA website. It will take about 30 minutes of your time.
Setting the scene
The EES processes personal data, including biometric data, namely fingerprints and facial images. Biometric data are sensitive personal data, as they allow for unique identification or authentication of a natural person. The central storing of data of hundreds of millions of people bears fundamental rights risks, which must be mitigated by effective data protection safeguards.
Selected findings from the field research
Qualitative research:
- The field research at BCPs suggests that, in general, privacy is better protected at air borders, with some exceptions during busy travel periods.
- The interoperability of the EU IT systems amplifies the risks related to data protection, according to experts in Germany, France and Italy.
- In Bulgaria and Poland data protection experts and academics noted that gaps in administrative capacity and operating procedures as well as limited oversight may lead to unlawful access to EES data, creating risks of data protection violations.
- An academic in Bulgaria identified risks to the right of good administration and the right to an effective remedy, as third-country nationals might face challenges in accessing their own data stored in the EES, or having incorrect data corrected or deleted.
Border guards survey:
- 87% of border guards consider the availability of a comfortable setting that ensures privacy to be an important safeguard for data quality. (n=176)
Legal references
Article 16 of the EES Regulation lists the personal data that the EES processes. Article 39 gives guidance on how to process personal data in the EES lawfully.
More generally, Article 49 of the EES Regulation reminds that EU data protection law, particularly the GDPR and Directive (EU) 2016/680, applies to Member States’ processing of personal data in the EES. Under Article 5 of the GDPR, personal data must be processed lawfully, fairly and in a transparent manner. The processing of biometric data is subject to the limitation and safeguards in Article 9 of the GDPR.
Article 52 of the EES Regulation describes data protection rights, such as the right to access personal data stored, or the right to ask that data be rectified or deleted. According to Article 50 (1)(l) all individuals must be informed of their right to lodge a complaint with the relevant supervisory authority if they believe their data protection rights have been violated (for information provision see section 1).
Guidance points
The following actions may help national authorities to process personal data in the EES in line with EU data protection law:
- Conducting a data protection impact assessment before operating new EES components, involving national data protection authorities, as appropriate.
- Ensuring the security and regular maintenance of hardware and software developed and deployed at the national level through continuous technical optimisation, proactive safeguards and system checks.
- Taking multi-layered cybersecurity measures to protect personal data against unauthorised access, hacking, or misuse.
- Offering support and guidance to BCPs on how to provide an environment that ensures confidentiality and privacy when collecting personal data from third-country nationals.
- Supporting BCPs to install privacy screen protectors on self-service systems and protective foil to screens or border control booth windows, as appropriate.
- Raising awareness on the consequences for data entry mistakes and the particularly severe impact they can have on the person concerned.
- Offering training and guidance to front-line officers on data corrections to be made at first line (e.g. errors at self-registration) and cases to refer to second line (e.g. miscalculation of days of stay), based on agreed data correction policies.
- Offering training and guidance to officers on how to effectively inform third-country nationals who request the rectification, completion, or erasure of their data about the competent authority to contact and how to proceed with their request.
Sources, further reading:
- EES Practical Handbook
- FRA-ECtHR Handbook on European law relating to asylum, borders and immigration – Edition 2020 (update forthcoming in 2026), Chapter 2
- FRA-ECtHR Handbook on European data protection law – 2018 edition