The deal was struck after the US introduced more stringent airport security measures following the attacks on the US on 11th September 2001. The US threatened airlines who refused to supply the data with fines and with a withdrawal of landing permission.
The transfer agreement was made between the European Commission and the US Bureau of Customs and Border Protection and applied from May 2004 onwards, but the European Parliament took the Commission to the European Court of Justice (ECJ) and argued that this agreement itself was unlawful.
Today's judgment is a victory for the Parliament's position. "The Court annulled the Council decision approving the conclusion of the agreement," said an ECJ statement. "Neither the Commission decision nor the Council decision are founded on an appropriate legal basis."
The decision hinged on the European Commission's claim that the US provided an 'adequate level of protection' for the personal data, as required by the European Data Protection Directive of 1995.
The ECJ found that because the transfer of data was for related to national security, public safety or criminal purposes, the Directive did not apply. The transfer fell outside the scope of the Directive, the court judgment argued.
The ECJ has given the Commission and the US until the end of September to find an alternative legal grounding for their agreement.
A US official said: "We are working with the Commission and we will make the best efforts to find an agreed interim approach to data transfers which fully respect the ruling."
The Commission made an agreement that information would only be passed to the US Bureau of Customs and Border Protection in what the Commission described as an exercising of its 'political judgement'. With a number of outstanding decisions on data protection soon to be made by European law makers, the ECJ decision outlawing the Commission agreement is being seen as particularly important.
"I see the judgment as a shot across the bows," said Dr Chris Pounder, a data protection expert with Pinsent Masons, the law firm behind OUT-LAW.COM. "Security and privacy have to be balanced, which most reasonable people will accept, and there must be independent supervision of the whole process so that those who use powers to obtain personal data do not exceed those powers."
The UK could circumvent the ECJ ruling and could agree a bilateral deal with the US on airline passenger information. "From the UK perspective there is a flexibility in the Data Protection Act for the Home Secretary to determine by order that these transfers should occur," said Pounder. However, he added, "It is not clear whether or not the US administration will seek to pursue bilateral agreements or come to a fresh agreement with the European Commission or indeed indvidual airlines".
A Home Office spokeswoman said that the department was still considering the judgment. "We will need to study the judgment carefully to determine what, if anything, needs to be done to ensure that transfers of passenger name record data to the US authorities can continue to be made lawfully," said a Home Office statement.
