Microsoft Ireland Operations Limited – Court Ruling (Ireland, 2026)

The Irish Council for Civil Liberties (ICCL), a qualified entity, brought a representative action against Microsoft Ireland Operations Limited concerning the processing of personal data through the Xandr real-time bidding platform. ICCL alleged that personal data broadcast during real-time bidding auctions could include highly personal information and that the processing infringed several GDPR requirements, including transparency, data minimisation, security and consent obligations. It sought injunctive relief requiring Microsoft to cease, amend or restrict the processing. A dispute subsequently arose concerning the burden of proof and the parties' pleading obligations. ICCL argued that Articles 5(2) and 24(1) GDPR required the controller to demonstrate its compliance with the GDPR. Microsoft disputed that it was the relevant controller and argued that the ordinary rules of civil procedure placed the burden of establishing the alleged infringements on ICCL. The parties also disagreed about the information that had to be provided in the representative action. Microsoft sought further information concerning, among other things, the alleged infringements, the consumers affected and the funding of the proceedings. The court therefore determined several preliminary questions relating to the burden of proof, pleading requirements and access to information before the underlying GDPR allegations were decided. The court held that Articles 5(2) and 24(1) GDPR do not create a general reversal of the legal or evidential burden of proof. The claimant must first establish the matters for which it bears the burden, including that the defendant is a controller and that processing takes place which engages the relevant GDPR obligations. However, once those matters are established and compliance with a relevant GDPR obligation is at issue, the controller bears the legal and evidential burden of demonstrating compliance. In particular, where compliance with the principles in Article 5(1) GDPR or with the requirements covered by Article 24(1) GDPR must be determined, it is for the controller to prove that the relevant processing complies with those obligations. The Court considered this to follow from the accountability obligations. The court further held that the ordinary national rules on pleadings continue to apply to both parties. Each party must plead the material facts supporting the matters it is required to prove. Consequently, where the controller wishes to advance a positive case that it complied with the GDPR, it must plead the material facts on which that claim of compliance is based. Regarding the representative action, the court held that [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print Sections 19(10)] and [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print 19(11) of the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023] do not give the controller a standalone right to require the claimant to provide further information. However, the controller may rely on ordinary procedural mechanisms, including requests for particulars, discovery or disclosure under [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print Section 34(2)], where the applicable requirements are met, and may challenge the admissibility of the representative action. The court did not determine whether the processing through the Xandr platform actually infringed the GDPR. It also declined to determine certain additional questions, including the application of the "peculiar knowledge principle", because the necessary facts had not been agreed. No fine or corrective measure was imposed.