The European Court of Justice (ECJ) ruled that the decision to approve the data transfers, taken in May 2004 by EU governments and the European Commission, was "founded on an inappropriate legal basis."

The agreement requires European airlines to provide US authorities with 34 items of information on passengers, including name, address and credit card details, within 15 minutes of departure to the United States.

The US said the information was essential to fight terrorism following the Sept. 11, 2001 attacks on New York and Washington.

The EU decision was blasted by civil liberties groups at the time. The appeal to the ECJ was brought by the European Parliament, which contended it had no legal basis and infringed fundamental rights.

The ECJ did not rule on whether the deal infringed on passengers' privacy rights, but agreed with the parliament that it lacked an adequate legal basis.

No immediate impact

The ruling will not have any immediate impact on transatlantic air travel, as the court gave the European Commission and member states four months to negotiate a new agreement. The data transfers can continue until then.

"The commission will consult the USA on any changes that may be required as a result of this judgment," commission spokesman Johannes Laitenberger told a news briefing.

The US also said it would seek a temporary way forward with the EU, but said transatlantic travel should not be disrupted, nor security lowered.

European airlines said there should be no short-term implications for passengers because of the ruling.

"What we understand is that it has been ruled out on a technicality and the commission has been given the opportunity to find another legal basis to satisfy the court," said David Henderson, spokesman for the Association of European Airlines.