LUXEMBOURG - The European Union's top court scrapped a controversial EU decision approving the transfer of personal data about European air passengers to US authorities.

The European Court of Justice (ECJ) ruled that the decision to approve the data transfers, taken in May 2005 by EU governments and the European Commission, was "founded on an inappropriate legal basis".

The EU decision was blasted by civil liberties groups at the time, but the court did not rule on whether people's privacy was being invaded. In November, a top EU official rejected claims that the privacy of passengers had been violated.

The agreement between Brussels and Washington came as part of the security clampdown from the September 11, 2001, attacks in the United States.

Under it, airlines would be obliged to provide the US authorities with up to 39 pieces of data on passengers and crew -- including credit card information, addresses and telephone numbers -- 15 minutes before a flight's departure.

The appeal to the ECJ was brought by the European Parliament. The former president of the assembly, Pat Cox, said he believed that passengers' rights were being infringed by the transfers.

However the decision ruffled many feathers at the parliament because the assembly had been excluded from the process.

The Luxembourg-based top EU court gave the EU and the United States until September 30 to negotiate a new agreement. The data transfers can continue until then.