First of its kind Collective redress action in Ireland
Locations
The Irish Council for Civil Liberties ("ICCL") has initiated a collective redress action against Microsoft in the High Court, which is the first of its kind in Ireland. Collective redress is not a common feature in Irish law, however legislation permitting 'representative' actions in certain circumstances was introduced in 2023.
The ICCL has sought to bring these proceedings on behalf of all consumers in the State, asserting that their personal rights are being infringed by Microsoft's data processing. This case challenges Microsoft's real-time bidding ("RTB") advertising system, which the ICCL argues constitutes a serious breach of data privacy laws. Noting that the ICCL’s application appeared to be the first of its kind to come before the Irish courts, Mr Justice Barry O’Donnell said he was satisfied to deem the ICCL’s intended proceedings as a representative action.
What Is Real-Time Bidding?
The ICCL contends that Microsoft's RTB system violates GDPR by processing personal data in a way that lacks transparency and control. RTB is an automated process whereby advertising space is auctioned in real time as users browse the internet. The ICCL contends that this system broadcasts private information about individuals to advertisers without adequate safeguards, potentially exposing sensitive personal data.
Legal Basis for the Action
The ICCL is leveraging the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 (the "Act"), which transposed the EU Collective Redress Directive into Irish law. The Act allows for certain types of consumer actions to be managed on a collective rather than an individual basis, and it applies to various sectors, including data protection, financial services, and general consumer protection legislation.
The Act enables qualified entities ("QE"), such as the ICCL, to bring representative actions on behalf of affected consumers, without requiring them to file claims separately. The QE must be a non-profit organisation, be independent, and have a legitimate interest in ensuring the provisions of the Act are complied with. Private law firms cannot bring a representative action.
If successful, remedies may include compensation for affected individuals, injunctions requiring Microsoft to alter its RTB processes, and stricter compliance measures.
Conclusion
If the ICCL succeeds, this case could encourage similar collective actions across the EU, reinforcing consumer rights in the digital sphere, and it may have far-reaching consequences for digital advertising and consumer privacy across the European Economic Area
This case will demonstrate the operation of new 'representative action' regime introduced by the Act for the first time in Ireland. As this case unfolds, it will be closely watched by privacy advocates, legal professionals, and tech companies alike.
Written by Killian O'Reilly and Cian Ronan.