High Court - 2026 IEHC 640

Summary

The Irish High Court has ruled on preliminary questions concerning the burden of proof in a representative action brought by the Irish Council for Civil Liberties (ICCL) against Microsoft Ireland Operations Limited regarding the Xandr real-time bidding platform. The court held that while GDPR Articles 5(2) and 24(1) do not generally reverse the burden of proof, once a claimant establishes that a defendant is a controller and that relevant GDPR obligations are engaged, the controller must then prove its compliance.

Full text

Help High Court - 2026 IEHC 640: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 08:17, 2 October 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators348 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 08:17, 2 October 2026 High Court - 2026 IEHC 640 Court: High Court (Ireland) Jurisdiction: Ireland Relevant Law: Article 5(1)(f) GDPR Article 24 GDPR Section 19 Irish Representative Actions ActSection 23 Irish Representative Actions ActSection 34 Representative Actions Act Decided: 25.09.2026 Published: Parties: Microsoft Ireland Operations Limited Irish Council for Civil Liberties National Case Number/Name: 2026 IEHC 640 European Case Law Identifier: Appeal from: Appeal to: Unknown Original Language(s): English Original Source: Bilii (in English) Initial Contributor: bms A high court held that Articles 5(2) and 24(1) GDPR do not generally reverse the burden of proof, but the controller must prove compliance once the relevant GDPR obligations are engaged. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The Irish Council for Civil Liberties (ICCL), a qualified entity, brought a representative action against Microsoft Ireland Operations Limited concerning the processing of personal data through the Xandr real-time bidding platform. ICCL alleged that personal data broadcast during real-time bidding auctions could include highly personal information and that the processing infringed several GDPR requirements, including transparency, data minimisation, security and consent obligations. It sought injunctive relief requiring Microsoft to cease, amend or restrict the processing. A dispute subsequently arose concerning the burden of proof and the parties' pleading obligations. ICCL argued that Articles 5(2) and 24(1) GDPR required the controller to demonstrate its compliance with the GDPR. Microsoft disputed that it was the relevant controller and argued that the ordinary rules of civil procedure placed the burden of establishing the alleged infringements on ICCL. The parties also disagreed about the information that had to be provided in the representative action. Microsoft sought further information concerning, among other things, the alleged infringements, the consumers affected and the funding of the proceedings. The High Court therefore determined several preliminary questions relating to the burden of proof, pleading requirements and access to information before the underlying GDPR allegations were decided. Holding The High Court held that Articles 5(2) and 24(1) GDPR do not create a general reversal of the legal or evidential burden of proof. The claimant must first establish the matters for which it bears the burden, including that the defendant is a controller and that processing takes place which engages the relevant GDPR obligations. However, once those matters are established and compliance with a relevant GDPR obligation is at issue, the controller bears the legal and evidential burden of demonstrating compliance. In particular, where compliance with the principles in Article 5(1) GDPR or with the requirements covered by Article 24(1) GDPR must be determined, it is for the controller to prove that the relevant processing complies with those obligations. The Court considered this to follow from the accountability obligations in Articles 5(2) and 24(1) GDPR. The High Court further held that the ordinary national rules on pleadings continue to apply to both parties. Each party must plead the material facts supporting the matters it is required to prove. Consequently, where the controller wishes to advance a positive case that it complied with the GDPR, it must plead the material facts on which that claim of compliance is based. Regarding the representative action, the High Court held that Sections 19(10) and 19(11) of the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 do not give the controller a standalone right to require the claimant to provide further information. However, the controller may rely on ordinary procedural mechanisms, including requests for particulars, discovery or disclosure under Section 34(2), where the applicable requirements are met, and may challenge the admissibility of the representative action. The High Court did not determine whether the processing through the Xandr platform actually infringed the GDPR. It also declined to determine certain additional questions, including the application of the "peculiar knowledge principle", because the necessary facts had not been agreed. No fine or corrective measure was imposed. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the English original. Please refer to the English original for more details. [2026] IEHC 640 THE HIGH COURT COMMERCIAL Record No.: 2025/3009P 225 No. 48 COM IN THE MATTER OF THE REPRESENTATIVE ACTIONS FOR THE PROTECTION OF THE COLLECTIVE INTERESTS OF CONSUMERS ACT 2023 AND IN THE MATTER OF A REPRESENTATIVE ACTION AND IN THE MATTER OF REGULATION (EU) 2016/679 ("THE GENERAL DATA PROTECTION REGULATION") Between: IRISH COUNCIL FOR CIVIL LIBERTIES COMPANY LIMITED BY GUARANTEE Plaintiff -and- MICROSOFT IRELAND OPERATIONS LIMITED Defendant JUDGMENT of Mr Justice Rory Mulcahy delivered on 25 September 2026 Introduction 1. The Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 ("the 2023 Act") is an Act which enables consumers to seek collective redress for infringement of their rights pursuant to a range of EU law measures. It allows a body designated as a qualified entity to take an action on behalf of a group of consumers concerning breaches of their rights. 2. The 2023 Act gives effect to Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers ("the Representative Actions Directive" or "RAD"). Article 2(1) of the Directive provides that it applies to representative actions brought against infringements of the EU measures listed in the annex to the Directive. One of the measures listed is Regulation (EU) 2016/679 ("the General Data Protection Regulation" or "GDPR"). 3. In this representative action, the plaintiff ("ICCL"), a qualified entity, alleges that the defendant ("Microsoft") has infringed the GDPR in its processing of data subjects' personal data on Microsoft's Xandr platform, a platform which allows for the sale of online advertising space by real time bidding ("RTB"). 4. On 26 May 2025, ICCL brought an ex parte application before the High Court (O'Donnell J) seeking to have these proceedings declared an admissible representative action and leave to issue a plenary summons. The application purported to provide the information required by section 19(10) of the 2023 Act concerning (a) sources of funding, (b) the nature of the claim and the nature of the alleged infringement, and (c) the class or classes of consumers affected by the infringement. 5. By Order of that date, the court deemed the proceedings an admissible representative action and granted leave to issue the proceedings ("the Leave Order"). 6. The parties have exchanged pleadings, but each party has taken issue with the manner in which the other has pleaded its case. In simple terms, Microsoft complains that ICCL has inadequately particularised its complaint in its statement of claim. ICCL objects to Microsoft's reliance on bare denials or non-admissions in its defence. 7. Microsoft raised particulars on ICCL's claim on 8 September 2025, and ICCL replied on 22 September 2025. ICCL noted that the details of Microsoft's processing o

Entities