[JURIST] The European Court of Justice [official website] ruled [text; press release, PDF] Tuesday that an agreement [PDF text] between the European Union [JURIST news archive] and the US that compels European airlines to disclose information about passengers flying from Europe to the US is illegal. The so-called passenger name records deal [BBC Q&A], required European airlines to reveal the name, address, credit card information, and itinerary details to US officials within 15 minutes of the flight departure. Information that may reveal the passenger's religion or ethnicity, such as meal preferences, would be deleted from the record before handing the information over to US authorities. The agreement was negotiated to resolve concerns that US requirements that airlines operating flights to the US provide US authorities access to passenger data would conflict with EU data protection legislation. The European Parliament [official website] challenged the deal [JURIST report] in 2004, saying that there were inadequate data security measures in the US and fearing that the data would be used for purposes other than fighting terrorism and other serious crimes. The Court of Justice on Tuesday sided with the European Parliament, annulling both a European Commission [official website] decision [PDF text] finding that there the US had adequate security measures in place to protect the data and a European Council decision [PDF text] approving the EU-US agreement, saying that neither decision has an appropriate legal basis.

The transatlantic deal would have limited the amount of data that the US can collect from European airlines, and only allowed the US to store the information to fight terrorism and other serious crimes for three and a half years. US officials have threatened to fine European airlines up to $6,000 per passenger if it does not disclose the passenger data, potentially causing European airlines to lose customers to US airlines who will continue to hand over passenger information to US officials. European airlines will still hand over the passenger information until September, while the European Commission determines whether another legal basis exists for its finding that US protection of the data is adequate. AP has more.