Introduction
As discussed in a previous article, the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 (the Act) commenced in Ireland on 30 April 2024. The Irish Council for Civil Liberties (the ICCL), as a designated Qualified Entity (QE), has recently secured permission from the High Court to take Ireland’s first ever representative action.
Background to the Representative Action
The ICCL has been granted permission by Mr. Justice O’Donnell of the High Court of Ireland to take a representative action on behalf of online bidders on Microsoft’s real time bidding system (RTBS) for online advertising.
The ICCL proceedings will be “on behalf of all affected people in Ireland” whose personal data rights have allegedly been infringed by Microsoft’s RTBS, contrary to the EU General Data Protection Regulation (the Regulation).
On 26 May 2025, when granting permission, Mr. Justice O’Donnell indicated that he was satisfied that the ICCL’s case met the criteria for a representative action.
The order was made on an ex parte basis i.e. without a representative of Microsoft in attendance. This is not unusual in an application of this kind. While Mr. Justice O’Donnell granted permission to the ICCL to serve a plenary summons on Microsoft, he stated that Microsoft could choose to challenge the order and request for it to be overturned.
The ICCL is requesting court orders from the High Court preventing Microsoft from processing personal data, which it claims Microsoft is using for targeted advertising.
Papers in the proceedings are not public, but the ICCL have indicated in press releases that personal information alleged to have been shared includes a person’s intimate relationships, whether a person gambles, their finances and debt, and even sensitive information such as whether the person works in a sensitive national security role.
The ICCL allege that data belonging to individual users of the RTBS is being released to prospective advertisers, which raises legitimate concerns over whether the individual users of the RTBS have consented to the release of their data in the manner alleged. The ICCL allege that the release of personal data, without having obtained the necessary consent, is contrary to the Regulation.
An action on behalf of all users
Under section 23(6) of the Act, where a QE brings a representative action seeking injunctive relief on behalf of consumers, the QE has the ability to bring such an application on an ‘opt-out’ basis. This is distinct from when other reliefs such as damages are brought. In those cases, under section 24 of the Act, individuals must 'opt in' by informing the QE that they want to be represented.
Potential significance of the ICCL’s case
Microsoft have now been served with the plenary summons and appear to be appealing the original order. The first hurdle for the ICCL is, of course, Microsoft’s appeal but should the ICCL be successful with this representative action, it is likely to significantly affect Microsoft’s operation of the RTBS in all EU member states.
Regardless of the outcome of the ICCL’s case against Microsoft, it represents a milestone in the Irish judicial system. The availability of representative actions in Ireland now provides a significant redress mechanism for consumers against large corporate entities
