The UK acted unlawfully by passing evidence to the US that could lead to the execution of two British members of an Islamic State murder squad.
The Supreme Court said former Home Secretary Sajid Javid should not have passed information on Shafee Elsheikh and Alexander Kotey to the US.
Lord Kerr said the seven justices concluded the decision in 2018 breached the UK's strict data protection laws.
The Londoners, linked to 27 murders, are in US custody in Iraq.
Along with two other British men, they formed a foursome known as "The Beatles", allegedly helping to kidnap, torture and murder hostages.
They were seized by Kurdish forces in 2018 as the Islamic State group began to crumble - and the US says it wants to prosecute them if the UK won't put the men on trial in London.
Last year, the government agreed to hand over as many as 600 witness statements and related material after initially refusing to do so without a guarantee they wouldn't face the death penalty.
Elsheikh's mother, Maha Elgizouli, challenged the home secretary's decision to share that information with the US - not to prevent him from being prosecuted and jailed but to protect him from the death penalty.
Welcoming the ruling, her lawyers said she recognised the difficult issues her case had raised.
"She has always expressed her belief that her son, if accused, should face justice - and that any trial should take place in the UK," they said in a statement.
"She has been asking since November 2018 for the CPS to conduct a review of the claim that there was insufficient evidence for him to be charged and tried in the UK - a review that the CPS now says should be completed by April 2020."
Now the court has ruled in her favour. There must be a further decision over what the UK must now do to comply with the law - including potentially asking the US to hand back information.
A Home Office spokesperson said: "The government's priority has always been to maintain national security and to deliver justice for the victims and their families. This has not changed. We are clearly very disappointed with today's judgment and are carefully considering next steps."
Explaining the judgment over an unprecedented video link, due to coronavirus measures, Lord Kerr said: "Much of the information provided, or to be provided, to the US authorities consisted of personal data.
He said a transfer of personal data to a third country was only lawful if it was based on there being appropriate safeguards or on special circumstances.
"Here there was no adequacy decision and no appropriate safeguards," he added.
In the weeks leading up to the decision, British diplomats in Washington warned Mr Javid that US President Donald Trump would be "wound up" by any continued refusal by London to hand over the information American prosecutors needed.
Lord Kerr said the decision by Mr Javid to transfer the information was "based on political expediency, rather than strict necessity".
The seven justices however were split over whether the UK had a more wide-ranging legal bar on sharing any information with the US that could put someone at risk of capital punishment.
The UK currently won't extradite someone to face trial in the US or other countries unless it first receives an assurance that they will not be put to death.
However, the law on sharing information that could be used against someone already in the other country's custody, is less clear.
Lord Kerr said: "Law must be responsive to society's contemporary needs, standards and values, which are in a state of constant change. That is an essential part of the human condition and experience.
"I concluded, therefore, that a common law principle should be recognised whereby it is deemed unlawful to facilitate the trial of any individual in a foreign country where, to do so, would put that person in peril of being executed."
A majority of the other justices disagreed - concluding that the law did not extend that far because Parliament had not explicitly banned ministers from sharing information on criminals with countries that use the death penalty.