The European Union and the United States today vowed to strike a new deal allowing European airliners to transfer passenger data to US authorities, after the European Court of Justice today ruled the existing deal illegal.
Today's court decision means more queues and long hold-ups for Europeans at American airports once the current system is scrapped, unless a new arrangement can be reached.
The agreement between Brussels and Washington, which was blasted by civil liberties groups, was insisted on by America after the September 11, 2001 attacks.
It required European airlines to provide the US authorities with 34 pieces of information on each passenger including names, addresses and credit card information, within 15 minutes of a plane taking off. It was opposed by many European MPs as a breach of privacy laws.
But the 2004 deal was annulled not on the issue of privacy, but on the purely technical grounds that existing EU data protection law only covers commercial data, and was not wide enough in scope to cover data used for security purposes.
The EU and Washington now have until September 30 to negotiate a new agreement before the present arrangement expires.
Stewart Baker, the assistant secretary for policy at the US Department of Homeland Security, said: "It’s unimaginable that the data would cease to flow, that planes would cease to fly. I am confident we will find a resolution that will keep the data flowing and the planes flying."
Franco Frattini, the European justice commissioner, also said he was confident a new agreement on sharing passenger information would be reached in coming weeks.
"My view is that we will need to continue exchanging passenger data between the US and Europe for purposes of preventing terrorist attacks," he said. "I cannot imagine stopping the flow of exchanging data concerning the protection and security of people traveling to America from Europe and vice versa."
Lawyers warned however that there was not enough time to put such agreements in place before September - and that other legal challenges could now follow.
"Although the decision itself is correct, it leaves airlines in a very difficult position," said Bridget Treacy, head of the data protection and freedom of information team at City law firm Barlow Lyde & Gilbert.
"It may be that individual agreements are negotiated between EU member states and the US authorities, or between individual airlines and the US authorities, but neither route is practical within the available timeframe.
"It also remains to be seen whether the transfers might be challenged on other grounds, including human rights grounds, and in relation to other jurisdictions to which PNR data are also transferred."
MEPs meanwhile were celebrating the court ruling. Graham Watson, a Liberal Democrat MEP who led the campaign against the legislation, welcomed the result as a victory for the rights of the individual.
"The response to 9/11 has been costly, both to the taxpayer and to individual freedom. It has made us little, if any, safer," he said.
Claud Moraes, a Labour MEP on the European Parliament's justice and home affairs committee, said that handing over 34 pieces of information per passenger did not stop terrorists. "What you are doing is going on a very expensive fishing raid, taking pieces of information like credit card details that are not really necessary to target terrorism," he told BBC Radio 4's World at One programme.
"Giving out people's personal financial information is a big deal, you need good assurances, and we didn't believe the standard of assurances we were getting from the Department of Homeland Security and the US authorities."
But Bob Preston, the executive officer of the British Air Transport Association, which represents airlines, said that the court ruling left airlines caught between "a rock and a hard place", facing the possible loss of the right to land on US soil
"If they don't supply the information to the US border authorities, they are liable to fines of up to $6,000 per passenger, and loss of landing rights," he said.
"If we do supply the information, potentially we are breaking the law. What we want is for the EU member states and the US authorities to come up with a new agreement that's adequate under European law."
Mr Preston admitted that in a few cases there had been "problems" when European aircraft were forced to turn back because the US border authorities "detected someone on board that they didn't like".
In one high-profile case Yusuf Islam, the British singer-songwriter and peace activist formerly known as Cat Stevens, was deported, apparently in error.
The late Dr Zaki Badawi, the head of the Muslim College in Britain, was held at a New York airport for six hours and then denied entry because the US Immigration and Customs Enforcement said it had information indicating that he was "inadmissible". He had been due to give a lecture to the Chautauqua Institution in New York.
Pete King, a US Congressman who chairs the homeland security committee of the House of Representatives, was outraged that Mr Moraes doubted the US's word that the data was dealt with responsibly.
"I know how committed the department is to security, to privacy," he said. "For him to say not to trust... I don't know why, I mean, Michael Chertoff (the Homeland Security Secretary) is a former federal judge, a former federal prosecutor and a man of impeccable integrity...
"What we have to do is try to find a way to resolve this. But ultimately if we don't get what information we need, we will have to take what action we think is necessary."
There is already a vexed history between Washington and Europe on the level of information necessary for European passengers to enjoy smooth entry to the United States. The push for biometric passports has been driven largely by America’s entry requirements.
Washington's stance has been that without adequate data air passengers from Europe would experience long delays, as more processing would be required on arrival in America.
It has however moderated some of its original demands. The US had wanted to store the data for 50 years, but agreed to delete it after three-and-a-half years. It also agreed not to keep data about passenger's in-flight meal preferences, which could have suggested their ethnic and cultural origins.
Concern about a conflict with EU privacy laws led to protracted negotiations, ending in May 2004 when the Commission said it was satisfied with restrictions imposed on the use of the information by the US Bureau of Customs and Border Protection (CBP).
MEPs then challenged it, arguing that fundamental rights were being infringed and that there was no legal basis in EU law or supplying such detailed information.
The judges emphasised today that EU law on data protection included a full commitment to supporting the US in the fight against terrorism "within the limits imposed by Community law".
The UK Government was ordered to pay its own costs because the UK opted to support as a named individual country the defence mounted against the Euro-MPs’ case by the European Commission and by the 25 EU governments acting as the Council of Ministers.
