An EU decision made two years ago to share personal information about passengers flying from the Europe to the US with American authorities is illegal, the European Court of Justice ruled today.
The decision to share passenger name records, which include details such as citizens' names, addresses and travel schedules, came in the wake of the 11 September 2001 attacks and was intended to help the US pursue its so-called "war on terrorism".
The European Parliament opposed the agreement, which was brokered by the EU's executive body, the European Commission, and approved by the 25 national governments of the EU member states.
The Parliament appealed to the Court of Justice in Luxembourg, claiming that the Commission was wrong to conclude that European citizens' personal data would be adequately protected by authorities in the US, and that the national governments were wrong to approve the agreement to transfer the data, signed with the US government in May 2004.
The Court agreed with both claims by the Parliament and overruled both the Commission and the Council of national governments.
"Neither the Commission decision nor the Council decision are founded on an appropriate legal basis," the Court said in a statement.
The overturning of the decisions marks a victory for civil liberties activists, but it leaves travel companies, especially the airlines that must collect the passenger data and hand it over to US authorities, in a legal quandary.
Under US laws passed after 11 September 2001, airlines can be fined for failing to hand over the information.
The Court gave the Commission and the Council until 30 September to find another solution. The agreements signed two years ago will remain in place for another four months "for reasons of legal certainty", it said while European legislators seek an alternative.
Some national governments, including here in the UK, are considering striking a bilateral agreement with the US in order to continue sharing passengers' details with the authorities there.
A US official said: "We are working with the Commission and we will make the best efforts to find an agreed interim approach to data transfers which fully respect the ruling." The official said the US government remains committed to the principle of privacy. The aim during the four-month transition period is to avoid disruption to transatlantic traffic and to maintain a high level of security, he said.