High Court Sets Key Rules in Microsoft Ad-Tech Privacy Action

In a procedural ruling with major ramifications for data privacy litigation in Ireland, the High Court has delivered key directions regarding pleading standards and the burden of proof in representative actions. Mr Justice Rory Mulcahy, sitting in the Commercial Court, confirmed that technology giants facing collective legal challenges under the General Data Protection Regulation must substantiate claims of regulatory compliance with specific material facts. The landmark case, brought by the Irish Council for Civil Liberties against Microsoft Ireland Operations Limited, marks one of the first major tests of Ireland’s newly implemented collective redress framework.

Landmark Test for Representative Actions

The proceedings have been instituted under the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023. Enacted to transpose the European Union’s Directive on Representative Actions into Irish law, the legislation created an avenue for designated qualified entities to pursue collective actions on behalf of groups of affected individuals. Historically, Irish civil procedure lacked a formal class-action mechanism, leaving aggrieved consumers to rely on individual plenary summonses, small claims procedures, or representative proceedings with exceptionally strict common-interest requirements. By enabling the ICCL to act on behalf of wider consumer groups, the 2023 Act represents a fundamental evolution in how collective rights are litigated before the Courts Service of Ireland.

Central to the dispute is Microsoft’s advertising platform, Xandr, and its utilization of Real-Time Bidding architecture. When users load a webpage or launch a digital application, available digital advertising space is auctioned to potential advertisers within milliseconds. The ICCL contends that during these split-second auctions, the platform broadcasts bid requests containing highly sensitive and granular personal information to a vast network of commercial participants. The civil liberties body alleges that Microsoft acts as a data controller in respect of this data processing and has failed to adhere to the core principles of lawful, fair, and transparent data handling set out in European and domestic legislation.

Burden of Proof and Pleading Standards

The preliminary judgment addressed crucial procedural disputes concerning how each party must state their case in the formal pleadings. The ICCL had previously raised targeted inquiries regarding the mechanics of Microsoft’s data processing pipelines, answers to which the advocacy body argued were necessary to evaluate the lawfulness of the ad-tech framework. Microsoft had resisted answering several of these queries, prompting judicial determination on the threshold of factual disclosure required at the early stages of commercial litigation.

Ruling on the matter, Mr Justice Mulcahy affirmed established procedural tenets while clarifying their application to complex European data protection principles. The court held that ordinary pleading rules govern the proceedings, requiring each litigant to state the material facts upon which they intend to rely. Critically, the judge determined that where a dispute emerges regarding compliance with statutory data protection responsibilities, the evidentiary burden falls upon the data controller. Under Article 5(1) and Article 24(1) of the GDPR, an organization that seeks to mount a positive defence of statutory compliance must expressly plead the material facts supporting that defence, rather than relying upon broad denials.

Wider Implications for Digital Redress

This ruling signals that multinationals operating from Dublin will face rigorous procedural scrutiny when defending their ad-tech ecosystems against collective claims. For years, consumer advocates and digital rights organizations have expressed frustration with the procedural bottlenecks in individual administrative complaints submitted to regulatory bodies such as the Data Protection Commission. While regulatory investigations remain central to public enforcement, the emergence of the 2023 Act offers a parallel path for private collective redress that directly engages the High Court’s Commercial list.

The determination that defendants must shoulder the onus of proving adherence to Article 5(1) principles will directly influence how corporate legal teams approach High Court pleadings in future group actions. Rather than allowing tech entities to withhold operational details until the formal discovery phase, the Commercial Court has established that a defence claiming full regulatory compliance must be anchored in pleaded facts from the outset. As this action advances toward a plenary trial, practitioners across both personal injury and corporate litigation will be watching closely to see how the court balances commercial practices against consumer privacy rights.