To print this article, all you need is to be registered or login on Mondaq.com.
The Irish Council for Civil Liberties has initiated Ireland’s first representative action. The action has been taken against Microsoft on behalf of affected people in Ireland. It has been reported in the media that the Irish Council for Civil Liberties allege that users of Microsoft’s real time bidding system have had their personal data rights infringed. The outcome of the case will be of particular interest to Irish consumers and large corporates based in Ireland alike.
As discussed in a previous article, the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 (the Act) commenced in Ireland on 30 April 2024. The Irish Council for Civil Liberties (the ICCL), as a designated Qualified Entity (QE), has recently secured permission from the High Court to take Ireland’s first ever representative action.
The ICCL has been granted permission by Mr. Justice O’Donnell of the High Court of Ireland to take a representative action on behalf of online bidders on Microsoft’s real time bidding system (RTBS) for online advertising.
The ICCL proceedings will be “on behalf of all affected people in Ireland” whose personal data rights have allegedly been infringed by Microsoft’s RTBS, contrary to the EU General Data Protection Regulation (the Regulation).
On 26 May 2025, when granting permission, Mr. Justice O’Donnell indicated that he was satisfied that the ICCL’s case met the criteria for a representative action.
The order was made on an ex parte basis i.e. without a representative of Microsoft in attendance. This is not unusual in an application of this kind. While Mr. Justice O’Donnell granted permission to the ICCL to serve a plenary summons on Microsoft, he stated that Microsoft could choose to challenge the order and request for it to be overturned.
The ICCL is requesting court orders from the High Court preventing Microsoft from processing personal data, which it claims Microsoft is using for targeted advertising.
Papers in the proceedings are not public, but the ICCL have indicated in press releases that personal information alleged to have been shared includes a person’s intimate relationships, whether a person gambles, their finances and debt, and even sensitive information such as whether the person works in a sensitive national security role.
The ICCL allege that data belonging to individual users of the RTBS is being released to prospective advertisers, which raises legitimate concerns over whether the individual users of the RTBS have consented to the release of their data in the manner alleged. The ICCL allege that the release of personal data, without having obtained the necessary consent, is contrary to the Regulation.
Under section 23(6) of the Act, where a QE brings a representative action seeking injunctive relief on behalf of consumers, the QE has the ability to bring such an application on an ‘opt-out’ basis. This is distinct from when other reliefs such as damages are brought. In those cases, under section 24 of the Act, individuals must ‘opt in’ by informing the QE that they want to be represented.
Microsoft have now been served with the plenary summons and appear to be appealing the original order. The first hurdle for the ICCL is, of course, Microsoft’s appeal but should the ICCL be successful with this representative action, it is likely to significantly affect Microsoft’s operation of the RTBS in all EU member states.
Regardless of the outcome of the ICCL’s case against Microsoft, it represents a milestone in the Irish judicial system. The availability of representative actions in Ireland now provides a significant redress mechanism for consumers against large corporate entities
Read more on Mondaq Business Briefing
