Representative Actions Update: Commercial Court Clarifies the GDPR Burden and New Court Rules

Two recent developments concerning representative actions under the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 (2023 Act) provide helpful guidance on how such actions will proceed before the Irish courts. (Further information on the 2023 Act can be found in our previous briefings linked below).

Firstly, in Irish Council for Civil Liberties v Microsoft Ireland Operations Limited [2026] IEHC 640, the Commercial Court delivered an important judgment clarifying the operation of the GDPR’s burden of proof framework, in what is also the first major judgment under Ireland’s representative actions regime.

Secondly, a new statutory instrument, Rules of the Superior Courts (Representative Actions for the Protection of the Collective Interests of Consumers Act 2023) 2026 (S.I. No. 488 of 2026) (Representative Action Rules) introduce a dedicated procedural framework for representative actions in the Irish courts. These Rules came into operation on 12 October 2026.

Background to the Commercial Court Proceedings

The 2023 Act permits designated qualified entities to bring representative proceedings on behalf of consumers.

The Irish Council for Civil Liberties (ICCL), a qualified entity, has issued representative proceedings against Microsoft, alleging GDPR infringements arising from the processing of personal data through its Xandr real-time bidding advertising platform.

The action was declared an admissible representative action by the High Court on 26 May 2025. Disputes subsequently arose between the parties in relation to the adequacy of both sides’ pleadings and what effect, if any, the provisions of the GDPR and/or the fact that this is a representative action, had on the rules of pleading and/or the burden of proof applicable to this case.

A trial of preliminary issues was proposed by the parties and the court concluded that it would address the questions posed and provide answers insofar as it was possible and appropriate to do at this early stage in the proceedings.

Court Findings on Burden of Proof and Pleadings

Issue 1 - Burden of proof.

Generally, the burden of proof in civil cases lies on a plaintiff. Microsoft argued that at all times both the legal and evidential burden rests on ICCL (as the plaintiff) to prove its claim that there had been infringement of GDPR.

The High Court held that there is no general reversal of the legal or evidential burden in GDPR infringement proceedings. Where the court is required to determine whether there has, in fact, been compliance with specific obligations under the GDPR, the plaintiff must first establish those matters for which it bears the burden of proof (for example, that a defendant is a data controller and that personal data is being processed in a manner that engages the GDPR). However, once those matters have been established by the plaintiff, the defendant will bear the onus of proving that it has complied with any obligation imposed on it.

Issue 2 - Pleadings

The court confirmed that the Rules of the Superior Courts (RSC), which govern pleadings in High Court actions, including Order 19, rules 3, 5 and 7 RSC, apply in the ordinary way to both parties in a representative action. Each party must plead to the material facts it relies on in order to establish the matters which it must prove in the proceedings.

The extent to which a defendant must plead the factual basis for compliance with GDPR obligations where it denies that it is the data controller but pleads, in the alternative, compliance with a data controller’s obligations, was also at issue. The court clarified that if a defendant wishes to make an affirmative case of compliance by way of defence, it must plead the material facts on which it will rely. If a party does not plead material facts, it may subsequently not be permitted to make a positive case.

Issue 3 - Peculiar knowledge.

The court declined to determine issues concerning peculiar knowledge (where a matter is peculiarly within the knowledge of one party) and whether it reverses the legal or evidential burden of proof, noting that it was not suitable for abstract determination without an agreed factual matrix.

Information Underpinning Leave to Issue a Representative Action

It is a requirement of the 2023 Act that a qualified entity must first obtain leave from the court to have an action declared an admissible representative action before it can proceed. Certain information must be submitted to support the application as prescribed by section 19 of the 2023 Act, including sources of funding, the nature of the claim and alleged infringement, the class of consumers affected by the infringement and sufficient information regarding those consumers to allow the court to assess the admissibility of the action.

Following an ex-parte application, the High Court on 26 May 2025 deemed these proceedings an admissible representative action. Microsoft subsequently argued that the supporting information provided for this application was inadequate. It reserved its rights and issued a motion seeking an order directing ICCL to provide further information. ICCL asserted that the defendant had no right to an order directing the provision of more information than was deemed sufficient by the court when granting leave.

The High Court held that section 19 of the 2023 Act does not give a defendant a standalone right to further information about the matters the plaintiff put before the court when seeking leave. However, a defendant can still seek to challenge admissibility and seek discovery or raise particulars through ordinary mechanisms. In addition, a defendant can seek disclosure of specific evidence which it believes to be in the possession of a qualified entity (section 34(2) of the 2023 Act).

New Rules of the Superior Courts for Representative Actions

The Representative Actions Rules, which came into operation on 12 October 2026, are set out in Part V of Order 15 RSC and include the following:

Admissibility applications

• A qualified entity seeking an order deeming a representative action admissible may apply to the court on notice to the defendant. It must provide sufficient information on affidavit to enable the court to properly assess the admissibility application.

• The defendant may file a replying affidavit which can include facts supporting a contention regarding compliance with the designation criteria for qualified entities. The defendant is also entitled to apply for an order declaring the representative action inadmissible.

• This is a notable development. In ICCL v Microsoft admissibility was determined on an ex parte basis and the defendant subsequently sought further information about the material put before the court. The Representative Actions Rules envisage an inter partes process at the admissibility stage of proceedings.

• In actions seeking redress under section 26 of the 2023 Act, each qualified entity must, before the admissibility hearing, lodge in court a list of the names (or other unique identifiers) of the consumers who have requested to be represented in the action and deliver a copy to the defendant. There are also obligations in terms of delivering updated lists during the course of the proceedings.

Injunctions

• Where a qualified entity intends to seek an injunction, it must first satisfy the court by way of an ex-parte application that it sought to engage with the trader in an effort to resolve the alleged infringement, as required by the 2023 Act.

Settlement and redress

• In redress actions, the court may, of its own motion or on application of the parties, invite the parties to reach a settlement within a time limit it considers reasonable, and may adjourn the proceedings to facilitate engagement.

• Where a settlement does not identify the individual consumers entitled to benefit, it will be necessary to explain how the redress measures will be given effect for the benefit of the consumers concerned.

• The court may make such orders, including consequential orders, as it considers necessary to give effect to any redress measures ordered.

Key Takeaways

• ICCL v Microsoft provides important early guidance on the conduct of representative actions under the 2023 Act and on the allocation of the burden of proof in GDPR litigation.

• In particular, the court’s finding that a controller bears the burden of establishing compliance with GDPR obligations, once it has been established that those obligations arise, will have implications for the pleading and defence of data protection claims.

• The judgment also confirms that representative actions appear to remain subject to the ordinary rules of pleading and procedure.

• Section 19 of the 2023 Act does not confer on a defendant a standalone entitlement to further information regarding materials relied upon when leave was obtained to bring representative proceedings.

• The Representative Actions Rules, which apply to proceedings commenced on or after 12 October 2026, establish a dedicated procedure for representative actions in Order 15 RSC.

• Admissibility applications must now be brought on notice, with defendants able to file replying evidence in opposition to the application.

• The court has express powers to encourage settlement within fixed time limits, and settlement approval applications must explain how redress will reach the consumer class where individual beneficiaries are not identified.

Further Reading

Representative Consumer Actions

Representative Consumer Actions: Update

Representative Consumer Actions Legislation signed into Law

Representative Consumer Actions Legislation Commenced

Consumer Representative Actions: Designation of Ireland’s First ‘Qualified Entity’