The European Parliament took the matter to the court in Luxembourg due to concerns that passenger data may not be adequately protected by the U.S. government under the 2004 "passenger name agreement" introduced in the wake of the September 11, 2001 attacks.

The ruling means the agreement - signed between the European Union's executive body the European Commission, and the U.S. government - is invalid and is currently under a four-month hiatus.

The court gave the commission until September 30 to find another solution. Plans are under way to sign a new agreement that provides more than 30 hit points of ID data per passenger.

The move is a victory for civil libertarians but it leaves travel companies, especially the airlines that must collect the passenger data in a legal quandary. Under U.S. laws passed after September 11, 2001, airlines can be fined for failing to hand over the information.

Irene Graham, Electronic Frontiers Australia executive director, said providing information to another country's immigration department raises huge privacy issues about the security of data.