Irish High Court sets proof sequence in ICCL’s Microsoft data-rights case

A preliminary ruling about proof

On 25 September 2026, the Irish High Court issued a preliminary judgment in Irish Council for Civil Liberties v Microsoft Ireland Operations Ltd, [2026] IEHC 640. The case is a representative action seeking injunctive relief over alleged processing of personal data through Xandr, Microsoft’s real-time advertising platform. ICCL alleges that information about people is broadcast during ad auctions and that the processing breaches the GDPR. Those are pleaded allegations, not findings that Microsoft violated the law. The judgment addresses how the parties must plead and prove issues before the underlying allegations are tried.

The court considered four preliminary questions after disputes over the parties’ statements of case. Its central clarification concerns sequence: who must first establish that GDPR duties are engaged, and who must then demonstrate compliance with those duties. This is a first-instance procedural decision in an ongoing case, not a final judgment about the platform’s data practices or an appellate ruling.

A threshold followed by a compliance burden

The court rejected a blanket reversal of the burden of proof. ICCL must establish that Microsoft is a controller of the personal data at issue and that the relevant processing engages GDPR obligations. Without those threshold facts, controller duties cannot be assumed to apply to Microsoft in this dispute. The court also explained that a claimant cannot simply allege a GDPR breach and require the defendant to disprove it.

But that threshold does not require ICCL to prove the controller’s non-compliance once a specific obligation is engaged. Under Articles 5(2) and 24(1), the controller is responsible for, and must be able to demonstrate, compliance with the GDPR’s principles and applicable duties. The court held that if ICCL establishes the facts that engage a relevant obligation, Microsoft carries the ultimate legal and evidential burden of demonstrating compliance with that obligation. The GDPR text supplies the accountability provisions the court interpreted.

In practical terms, the ruling separates two questions often compressed into one. First: is this defendant responsible for processing personal data in circumstances governed by the claimed GDPR rule? The claimant must establish that gateway. Second: where that rule requires a controller to demonstrate compliance, has the controller done so? The controller bears that burden on the specific compliance issue. The judgment does not say that every disputed fact, every GDPR provision, or every issue in every data case automatically shifts to a company.

The statutory route and its limits

The claim seeks an injunction through Ireland’s Representative Actions for the Protection of the Collective Interests of Consumers Act 2023. Section 23(7) says a qualified entity seeking an injunction need not prove actual consumer loss or the trader’s intent or negligence. The High Court treated that as removing those matters from the required proof for this remedy, not as reversing the burden on all elements of the case. The Act also distinguishes injunctions from redress measures, which are governed by separate provisions.

That distinction matters for accountability. A group action can provide a way to seek a practice-changing order without each affected person first proving individual damages. Yet the route does not eliminate the need to identify the relevant controller, processing, and legal obligation. Nor does permission to bring a representative action decide that an infringement happened. Admissibility and the substantive merits are different procedural stages.

What remains for the merits

The judgment does not decide whether Xandr processes personal data in the manner ICCL alleges, whether Microsoft is the controller for the specific processing, or whether that processing complies with each GDPR requirement. It answers legal questions about pleadings and the burdens attached to particular issues. The alleged data flows and Microsoft’s role still have to be established on evidence in the action. The High Court’s order should therefore not be paraphrased as “Microsoft must prove it did nothing wrong.”

Our analysis: the decision gives accountability a conditional structure. A claimant must connect the defendant to identifiable processing and show that the relevant legal duty is engaged; after that, a company cannot answer a compliance question merely by pointing back to the claimant’s initial burden. The evidence needed to show that processing follows the GDPR may sit substantially with the organization that designs and operates it. Article 5(2) recognizes that asymmetry through a specific duty to demonstrate compliance, while the court’s gateway requirement prevents that duty from becoming a free-standing presumption of liability.

This procedural allocation may affect how the case is prepared and which records become important, but the ruling itself awards no remedy and makes no finding of harm or unlawful conduct. It is a concrete development in corporate and human-rights accountability through data protection: it clarifies how a representative plaintiff can litigate a company’s claimed responsibility without turning a preliminary decision into a merits judgment.