Reviewing Five Years of Social Media for Travelers

The United States is considering a proposal that could significantly impact the way travelers from 42 countries, including the United Kingdom, apply for entry into the country. The plan, introduced by the U.S. Customs and Border Protection (CBP), would require applicants for an Electronic System for Travel Authorization (ESTA) to provide personal information from their social media accounts over the past five years.

This new requirement is based on Executive Order 14161 issued by former President Donald Trump, which emphasized the need to protect American citizens from individuals who may pose a threat to national security or engage in harmful activities. As part of this initiative, the CBP has proposed adding social media data as a mandatory element for ESTA applications.

If approved, this proposal would mean that any traveler from the listed countries would be required to share their social media history. This raises significant concerns about privacy and data protection, particularly given the sensitive nature of the information involved.

Potential Privacy Concerns

Paul Bernal, a Professor of Information Technology Law at the University of East Anglia, highlighted the potential risks associated with this proposal. He noted that while consent plays a role in data sharing, the implications of such a policy are far-reaching. Bernal explained that by applying for a visa, individuals effectively agree to the terms of that visa, which could include sharing their social media data.

However, he also raised concerns about how this data might be used. For instance, if someone expresses anti-Trump sentiments on their social media, it could lead to the revocation of their visa or even deportation. The professor questioned whether travelers are being asked to disclose their social media accounts or if they are being forced to grant access to them.

Under European and UK privacy laws, the information collected through this proposal would be considered personal data. Bernal stressed that if individuals agree to the terms of their visa, they are essentially giving their consent to share this data. However, he warned that this could lead to misuse, especially if the data is not deleted after the visa decision is made.

Countries Using ESTA

The list of countries that use the ESTA program includes:

• Australia
• Andorra
• Austria
• Belgium
• Brunei
• Chile
• Croatia
• Czech Republic
• Denmark
• Estonia
• Finland
• France
• Germany
• Greece
• Hungary
• Iceland
• Ireland
• Israel
• Italy
• Japan
• Latvia
• Liechtenstein
• Lithuania
• Luxembourg
• Malta
• Monaco
• Netherlands
• New Zealand
• Norway
• Poland
• Portugal
• Qatar
• San Marino
• Singapore
• Slovakia
• Slovenia
• South Korea
• Spain
• Sweden
• Switzerland
• Taiwan*
• United Kingdom**

Broader Implications

Bernal also pointed out that the collection of social media data could be seen as a "data grab" rather than a direct necessity for visa processing. He suggested that the data might be used for purposes beyond its initial intent, raising questions about transparency and accountability.

Professor Muttukrishnan Rajarajan, director of the Institute for Cyber Security at City, St George’s University of London, echoed similar concerns. He noted that while law enforcement agencies around the world already analyze social media data to combat terrorism, the collection of such data over a five-year period without anonymization is a violation of privacy.

He emphasized that sharing personal social profiles with other agencies could be an intrusion on individual privacy, as most privacy laws allow law enforcement to mine and profile personal data under the guise of "national security."

What Information Would Travelers Have to Provide?

In addition to social media data, travelers would also be required to provide:

• Business email addresses used in the last ten years
• Telephone numbers used in the last five years
• Email addresses used in the last ten years
• IP addresses and metadata from electronically submitted photos
• Family member names (parents, spouse, siblings, children)
• Family number telephone numbers used in the last five years
• Family member dates of birth
• Family members’ places of birth
• Family member residencies
• Biometrics – face, fingerprint, DNA, and iris
• Business telephone numbers used in the last five years

Public Comments and Next Steps

The proposal is open for public comments for the next 60 days, allowing individuals to voice their concerns or support for the changes. The review process will also include examining visa holders' records in their home countries and monitoring their social media activity.

Earlier this year, the Trump administration announced a review of all 55 million visa holders to identify those who should be deported. This includes checking for violations such as overstaying their visas, committing crimes, posing a safety threat, or being involved in terrorist activities.

Applicants are also required to set their social media accounts to public when attending a visa interview, further emphasizing the importance of transparency in the application process.