On 25 September 2026, the High Court delivered its judgment in the case of Irish Council for Civil Liberties CLG v Microsoft Ireland Operations Limited [2026] IEHC 640, the first substantive decision under the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 (the “2023 Act”).

The case concerns ICCL’s representative action against Microsoft alleging breaches of the GDPR, and more particularly personal data processed through Microsoft’s Xandr advertising platform.

The Court clarified that there is no general reversal of the burden of proof in GDPR proceedings. The claimant must first establish that:

• The defendant is a data controller
• Personal data is being processed
• Relevant GDPR obligations are engaged, such as obligations imposed on a controller under Article 5(1), and/or that any processing of personal data complies with Article 24(1).

Once this is established, the legal and evidential burden of proving compliance with those obligations falls on the data controller.

The judgment confirms that the ordinary pleading rules apply, meaning where a defendant bears the burden of establishing compliance, it must plead the material facts supporting its case and cannot rely on a bare or blanket denial.

The peculiar knowledge principle provides that the onus of proof can be reversed where a matter is not within the means of knowledge of one party and is peculiarly within the knowledge of the opposing party, which differs from the general rule of law that it lies upon a Plaintiff to prove affirmatively all the facts entitling them to relief. The Court in these proceedings declined to decide whether the “peculiar knowledge” principle can independently reverse the burden of proof, noting that its application depends on the facts of each case.

The Court further determined that sections 19(10) and 19(11) of the 2023 Act do not give a defendant a standalone right to demand further information from a claimant about admissibility. Other mechanisms, including particulars, discovery, disclosure and applications to set aside an admissibility order, remain available where their respective requirements are met.

The decision provides useful guidance on the procedural framework for representative actions and the application of the burden of proof in respect of the GDPR in Ireland. The substantive issues in the proceedings, including whether Microsoft is a data controller, remain to be determined by the Court.