FROM DIGITAL BORDERS TO DATA DIPLOMACY: EXTERNAL ACCESS TO EU BIOMETRIC MIGRATION DATABASES AND EUROPEAN DATA SOVEREIGNTY

Abstract

The EU has the most extensive system of biometric migration databases in the world-containing fingerprints and facial images of tens of millions of third-country nationals in Eurodac, the Visa Information System, the Schengen Information System, the Entry/Exit System, and their networked, interoperable sisters under the 2019 interoperability framework. What were initially purely internal measures for border and migration control are now increasingly becoming objects of third countries' externally driven access requests. This article maps the legal and institutional mechanisms by which third countries gain, or are attempting to gain, access to biometric data stored in, or emerging from, EU migration databases, and considers their implications for the EU's narrative of data sovereignty. Building on a qualitative research design utilizing doctrinal legal analysis and interpretive document analysis of secondary sources, I identify five mechanisms of access: transfer for returns purposes; urgent transfer for law enforcement purposes; a new Interpol interface mechanism; access through EU Agency-level operational agreements; and conditionality-driven mechanisms such as that envisioned in the EU-US Enhanced Border Security Partnership. I find that each mechanism undermined a pillar of EU data protection regulation: the adequacy mechanism, purpose limitation, reciprocity, or effective remedy. I argue that the source of eroding European data sovereignty lies less with external invasion than it does with internal abdication. The findings contribute to the literatures on digital sovereignty, fundamental rights, and the external dimension of EU migration management.