Representative actions: ICCL launches action against Microsoft

On 26 May 2025, the Irish Council for Civil Liberties (ICCL) announced that it had been granted permission to bring a High Court class action against Microsoft. The ICCL formally launched that action on 29 May 2025.

The case will be the first class action claim in Ireland brought pursuant to the EU’s Collective Redress Directive (EU) 2020/1828 (the Directive), as transposed in Ireland by the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 (the Act).

ICCL’s claim

ICCL has not released full details of the claims it is making or the remedies it is seeking against Microsoft, and the documents that it has filed in the Irish Courts are not publicly available. However, the ICCL’s press releases (here and here) give some indication of  scope of its case.

ICCL alleges that Microsoft’s ‘Real Time Bidding’ advertising system constitutes a data breach under the GDPR, and that it causes users’ sensitive personal data to be inappropriately shared with third parties. ICCL argues this system is exposing users to malicious profiling and discrimination.

Collective Redress in Ireland

The Act was commenced on 30 April 2024, and this action against Microsoft is the first action brought under the Act since its introduction.

The Directive requires Member States to introduce a system whereby appropriate organisations are awarded the status of ‘qualified entity’ (QE). Under the Act, QEs are permitted to operate as the plaintiff in representative actions and have the rights and obligations of a standard plaintiff under Irish law. To date, only two entities have been registered as QEs in Ireland: the ICCL and Max Schrems’ organisation, noyb: European Center for Digital Rights.

In general, the litigation process under the Act is expected to be very similar to that under the standard Irish regime. In particular, the rules on discovery will be the same. That said, one important distinction is that the individual consumers will generally be shielded from having to pay a defendant’s legal costs, if the representative action is unsuccessful.

To be granted permission to bring a claim, a QE must present the Court with certain information, including: the sources of funding of the representative action; the nature of the claim; and, the class or classes of consumers affected by the alleged infringement. The Court maintains the right to dismiss an application for a representative action which appears to be manifestly unfounded.

Funding of representative actions

As noted, the Act provides that a QE must provide the Court with information relating to the sources of funding of the representative action. The Act does not alter Ireland’s existing position that third party funding of litigation is generally prohibited.

Available remedies

The Act makes provision for the Court to grant a wide range of consumer remedies, which include compensation; replacement; and contract termination.

A notable feature of the Act is that it introduces the ability for QEs to seek injunctive relief on behalf of consumers on an ‘opt-out’ basis (see section 23(6) of the Act). Collective claims for other “redress measures”, such as damages, must be brought on an opt-in basis - i.e. a consumer must notify the relevant QE that it wishes to be represented (see section 24). Consumers may opt in at any time up until the representative action is deemed admissible by the Court (as has now occurred in the ICCL matter). Under the Act, a QE may pursue either or both remedies in the same representative action.

The ICCL notes in its statement that it is taking the legal action “on behalf of all affected people in Ireland” to “force Microsoft to bring its systems into compliance with the EU’s GDPR” and make no reference to damages. This may indicate that ICCL will be focused on injunctive relief on behalf of all Irish Microsoft users, as opposed to seeking redress measures (such as damages).

The Directive envisages that actions brought pursuant to the Directive will have cross-border impact as it specifically provides that Member States must ensure that where the alleged infringement is likely to affect consumers in different Member States, the representative action can be brought before the Court by several QEs from different Member States in order to protect the collective interests of consumers in different Member States.

In the case of the action brought by the ICCL, it is unclear, for now, if its intention is to bring a collective action on behalf of Irish consumers only or if it will purport to seek a remedy on behalf of any EU users who may be impacted by the processing.

For more information on the Act, please see our previous updates including: Representative Actions: Irish Act is Commenced | May - 2024 and Representative Actions: Designation of Ireland’s first ‘Qualified Entity’ | June - 2024

For further information in relation to this topic, please contact, John Cahir, partner, Stephen King, partner, Sinéad Hayes, Knowledge Consultant or your usual contact on the Technology or Disputes teams.

Date published: 30 May 2025