Since an EU-US agreement in May 2004, European airlines have been obliged to give US authorities 34 items of information on passengers flying to the United States, including name, address, all forms of payment and contact telephone numbers.
But the European Court of Justice ruled on Tuesday that the EU Council of Ministers' decision to sign the agreement lacked an adequate legal basis and infringed individual rights.
"Consequently, the court annulled the council decision approving the conclusion of the agreement and did not consider it necessary to consider the other pleas relied on by parliament," a court statement said.
The United States said the transfer of personal details was essential to fight terrorism after the September 11 attacks on New York and Washington by suicide aircraft hijackers.
The court gave executive European Commission and member states four months to find a solution by maintaining the legality of the decision to sign the agreement until September 30 "for reasons of legal certainty".
But it did not rule out on the politicians' claims that the agreement infringed on passengers' privacy rights.
In an initial response, the United States pledged to seek a temporary way forward with the EU and said summer transatlantic air traffic should not be disrupted, nor security lowered.
European airlines said there should be no short-term effect on travellers.
David Henderson, a spokesman for the Association of European Airlines, said: "What we understand is that it has been ruled out on a technicality and the Commission has been given the opportunity to find another legal basis to satisfy the court."
Among possible options, the EU executive could seek to reintroduce the agreement on a different legal basis, try to renegotiate the deal, or individual member states could conclude bilateral pacts with the United States instead, experts say.
Washington has said it does not favour a bilateral approach.