The European Union's highest court ruled Tuesday that the EU acted illegally when it struck a deal giving U.S. authorities personal details of airline passengers in a bid to fight terrorism.

Under an agreement reached in 2004, European airlines are compelled to turn over 34 pieces of information about each passenger -- including name, address and credit card details -- within 15 minutes of departure for the United States.

The United States says such measures are required to help fight terrorism. But the law has been heavily criticized in Europe as a violation of privacy.

The European Court of Justice said EU nations acted without the correct legal basis. It did not, however, take issue with specific measures of the law.

Lawyers have until Sept. 30 to address the concerns raised by the court. If they fail to fix legal technicalities by that date, airlines may have to change the way they collect and transfer data.

The European Parliament had asked the court to annul the deal which was reached with the Americans in May 2004 despite strenuous objections.

Washington has warned airlines face fines of up to $6,000 per passenger and the loss of landing rights if the relevant information is not passed on.

The European Commission said Tuesday it would work to find a solution within the 90-day deadline.

Airline representatives also expressed confidence that changes could be made to comply with the ruling without jeopardizing the substance of the agreement.

"It does not seem to alter the reality of the situation to any major extent," said David Henderson, a spokesman for the Association of European Airlines, which represents British Airways, Air France, Lufthansa and other top carriers. "It's really a problem for the lawyers," he added.

During the negotiations, the EU won some concessions from the Americans such as shortening the time the information is stored and deleting sensitive data such as meal preference, which could indicate a passenger's religion or ethnicity.

The U.S. also said the information would be shared with other countries on a restricted basis only.

EU and U.S. officials say the data collected can only be used to fight terrorism and other serious crimes, including organized crime. Under the current terms, the information can be stored for up to 3 1/2 years.