The European Court of Justice has annulled an EU-US agreement requiring airlines to transfer passenger data to the US authorities.
The US said the deal was essential after the 9/11 attacks
The court said the decision to hand over the data, including addresses and credit card details, lacked an "appropriate legal basis".
The US says the information helps identify potential terrorists.
EU and US officials say they are confident a solution can be found to enable the data transfers to continue.
Stewart Baker, an assistant secretary of state for the US Department of Homeland Security, said: "I am confident that we will find a solution that will keep the data flowing and the planes flying."
The agreement demands that within 15 minutes of take-off for the United States, a European airline must send the US authorities 34 items of personal information about the passengers on board.
Washington had warned that it would impose heavy fines and deny landing rights for any airline failing to comply with the agreement.
The US authorities also said passengers would be subject to long security checks on arrival if the data was not sent in advance.
The US demanded tighter airline security worldwide after the 11 September 2001 attacks on New York and Washington by suicide hijackers.
The European Parliament argued that the US did not guarantee adequate levels of data protection and that handing over the data violated passengers' privacy.
It asked the European Court of Justice to annul the deal.
However, the court did not consider the privacy argument in its ruling, and confined itself to examing the legal basis of the data transfer.
It said the EU Data Protection Directive, on which the Council of the European Union and the European Commission based their actions did not apply to data collected for security purposes.
It gave the EU until 30 September 2006 to find a new legal solution.
"The ruling ensures that there is no lowering of data protection standards, no effect on passengers, no disruption of transatlantic air traffic, and that a high level of security is maintained until 30 September," said the European Commission's chief spokesman Johannes Laitenberger.
"The Commission is committed to working with all parties involved to find an appropriate arrangement by that time."
"It does not seem to alter the reality of the situation to any major extent," said David Henderson, a spokesman for the Association of European Airlines
"It's really a problem for the lawyers."