Irish Council for Civil Liberties Company Ltd by Guarantee v Microsoft Ireland Operations Ltd

• Jurisdiction: Ireland
• Court: High Court
• Judge: Mr Justice Rory Mulcahy
• Judgment Date: 25 September 2026
• Neutral Citation: [2026] IEHC 640
• Docket Number: Record No.: 2025/3009P

In the Matter of the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023

And in the Matter of a Representative Action

And in the Matter of Regulation (EU) 2016/679 (“The General Data Protection Regulation”)

Between:

Irish Council for Civil Liberties Company Limited by Guarantee

Plaintiff

and

Microsoft Ireland Operations Limited

Defendant

[2026] IEHC 640

Record No.: 2025/3009P

225 No. 48 COM

THE HIGH COURT

COMMERCIAL

Injunctive relief – Representative action – Regulation (EU) 2016/679 – Parties agreeing to a preliminary trial – Whether it was appropriate to determine the proposed questions

Facts: The plaintiff, Irish Council for Civil Liberties Company Limited by Guarantee, a qualified entity, in this representative action, alleged that the defendant, Microsoft Ireland Operations Limited (Microsoft), had infringed Regulation (EU) 2016/679 (the GDPR) in its processing of data subjects’ personal data on Microsoft’s Xandr platform, a platform which allows for the sale of online advertising space by real time bidding. In the exchanges between the parties regarding the dispute about the adequacy of each other’s pleading, a question arose as to what, if any, effect the provisions of the GDPR and/or the fact that this was a representative action pursuant to the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 had on the rules of pleading and/or the burden of proof applicable to this case. In the circumstances, the parties ultimately agreed to a preliminary trial of four questions (some in more than one part) based on agreed facts. During the hearing of that trial, the High Court (Mulcahy J) suggested that the questions proposed for determination did not, in fact, reflect the dispute on those issues between the parties. Mulcahy J invited the parties to consider whether a revised formulation of the issues may better capture what was in dispute between them. Following the hearing, the parties proposed revised questions which they contended could be addressed by reference to the arguments which had already been advanced.

Held by Mulcahy J that the responses to the issues raised which he considered were appropriate to address were as follows: Issue 1(a) - there is no general reversal of the legal or evidential burden; however, if the court is required to determine whether there has, in fact, been compliance with specific obligations in the GDPR because a plaintiff has established to the necessary standard those matters on which it bears the burden of proof, the defendant will bear the onus of proving that it has complied with any obligation imposed on it by Article 5(1) of the GDPR and/or that any processing by it of personal data is in accordance with the GDPR within the meaning of Article 24(1). Issues 1(b) and (c) - the rules of pleading apply in the ordinary way to both parties; each must plead to the material facts it relies on in order to establish the matters which it must prove in the proceedings. Issue 1(d) - where a defendant will, where it arises as an issue, bear the burden of proving that it has complied with obligations under the GDPR, if it wishes to make a positive case of compliance by way of defence, it must plead the material facts upon which it will rely for the purpose of that defence. Issue 2 - ss. 19(10) and (11) of the 2023 Act do not confer on a defendant a stand-alone entitlement to seek the disclosure of further information by a plaintiff regarding the information required by s. 19(10) of the 2023 Act; this does not preclude a defendant from seeking particulars, discovery or disclosure under s. 34(2), where the requirements governing those procedures are satisfied, or from seeking to set aside an order deeming proceedings admissible.

Mulcahy J held that, in the absence of agreed facts, it was not appropriate to determine Issue 1(e) and Issue 3.

Issues determined.

JUDGMENT of Mr Justice Rory Mulcahy delivered on 25 September 2026

Introduction

1 . The Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 (“ the 2023 Act”) is an Act which enables consumers to seek collective redress for infringement of their rights pursuant to a range of EU law measures. It allows a body designated as a qualified entity to take an action on behalf of a group of consumers concerning breaches of their rights.

2 . The 2023 Act gives effect to Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers (“ the Representative Actions Directive” or “ RAD”). Article 2(1) of the Directive provides that it applies to representative actions brought against infringements of the EU measures listed in the annex to the Directive. One of the measures listed is Regulation (EU) 2016/679 (“ the General Data Protection Regulation” or “ GDPR”).

3 . In this representative action, the plaintiff (“ ICCL”), a qualified entity, alleges that the defendant (“ Microsoft”) has infringed the GDPR in its processing of data subjects' personal data on Microsoft's Xandr platform, a platform which allows for the sale of online advertising space by real time bidding (“ RTB”).

4 . On 26 May 2025, ICCL brought an ex parte application before the High Court (O'Donnell J) seeking to have these proceedings declared an admissible representative action and leave to issue a plenary summons. The application purported to provide the information required by section 19(10) of the 2023 Act concerning (a) sources of funding, (b) the nature of the claim and the nature of the alleged infringement, and (c) the class or classes of consumers affected by the infringement.

5 . By Order of that date, the court deemed the proceedings an admissible representative action and granted leave to issue the proceedings (“ the Leave Order”).

6 . The parties have exchanged pleadings, but each party has taken issue with the manner in which the other has pleaded its case. In simple terms, Microsoft complains that ICCL has inadequately particularised its complaint in its statement of claim. ICCL objects to Microsoft's reliance on bare denials or non-admissions in its defence.

7 . Microsoft raised particulars on ICCL's claim on 8 September 2025, and ICCL replied on 22 September 2025. ICCL noted that the details of Microsoft's processing of data were within the peculiar knowledge of Microsoft, that its claim was based on Microsoft's publicly available documentation and that, accordingly, Microsoft had sufficient information to enable it to plead its defence. Despite delivering a defence on 14 October 2025, Microsoft requested further detailed particulars on 18 November 2025. It subsequently issued a motion seeking to compel replies to those particulars. It also sought an order pursuant to section 19(10) and 19(11) of the 2023 Act directing the plaintiff to provide “ full and proper information” concerning the matters set out in section 19(10) of the Act.

8 . ICCL furnished a notice for particulars of Microsoft's defence on 28 October 2025. Microsoft replied on 24 November 2025. Notably, Microsoft characterised many of ICCL's requests for particulars as impermissible attempts to go behind non-admissions or denials.

9 . In the exchanges between the parties regarding the dispute about the adequacy of each other's pleading, a question arose as to what, if any, effect the provisions of the GDPR and/or the fact that this is a representative action pursuant to the 2023 Act had on the rules of pleading and/or the burden of proof applicable to this case.

10 . In the circumstances, the parties ultimately agreed to a preliminary trial of four questions (some in more than one part) based on agreed facts. During the course of the hearing of that trial, however, I suggested that the questions proposed for determination did not, in fact, reflect the dispute on those issues between the parties. In particular, Issues 1 and 3 as originally framed queried whether the national law rules of evidence and pleading would have to be adapted in light of the 2023 Act and/or the GDPR. In fact, as became clear from the parties' written and oral submissions, the parties agreed that the existing rules of evidence and pleading were sufficiently flexible as to be consistent with the arguments which they wished to advance, i.e. the rules did not need to be adapted. This agreement did not, however, resolve their dispute about the pleadings.

11 . In those circumstances, I invited the parties to consider whether a revised formulation of the issues may better capture what was in dispute between them. Following the hearing, the parties proposed revised questions which they contended could be addressed by reference to the arguments which had already been advanced. The issues as framed by ICCL are as follows:

ISSUE 1

• 1. In a representative action seeking injunctive relief pursuant to the 2023 Act, interpreted in the light of the RAD, in circumstances where the plaintiff's claim includes allegations that the defendant has infringed the GDPR:

  • (a) What effect, if any, does Article 5(2) GDPR and/or Article 24(1) GDPR have on the legal or evidential burden of proof on the parties?

  • (b) What effect, if any, does Article 5(2) GDPR and/or Article 24(1) GDPR have on the application of the rules of pleading in Order 19, rule 3, 5, and 7 of the Rules, as interpreted by case law, in relation to either the plaintiff or the defendant?

  • (c) In particular, to what extent, if at all, is the plaintiff relieved of the obligation to particularise the factual and legal matters it relies on in support of its claim in this representative action?

  • (d) In circumstances where the Defendant denies/does not admit that it is the data controller, but pleads in the alternative that, if it is determined to be the data controller, it has...