[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLv1k5mqR4ER6ugS01fRShi4Gps57nRNOphTMuvDweUk":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"cef0e4f6-cf7b-4234-b0f8-80919299734f","High Court - 2026 IEHC 640","high-court-2026-iehc-640-5f09c0","← Older revision Revision as of 08:06, 5 October 2026 Line 13: Line 13: |Original_Source_Name_1=Bilii |Original_Source_Name_1=Bailii |Original_Source_Link_1=https:\u002F\u002Fwww.bailii.org\u002Fcgi-bin\u002Fformat.cgi?doc=\u002Fie\u002Fcases\u002FIEHC\u002F2026\u002F2026IEHC640.html&query=(GDPR) |Original_Source_Link_1=https:\u002F\u002Fwww.bailii.org\u002Fcgi-bin\u002Fformat.cgi?doc=\u002Fie\u002Fcases\u002FIEHC\u002F2026\u002F2026IEHC640.html&query=(GDPR) |Original_Source_Language_1=English |Original_Source_Language_1=English","The Irish High Court has ruled on preliminary questions regarding the burden of proof in a representative action brought by the Irish Council for Civil Liberties (ICCL) against Microsoft Ireland Operations Limited. The case concerns allegations that Microsoft's Xandr real-time bidding platform infringes GDPR requirements. The court clarified that while GDPR does not generally reverse the burden of proof, once a claimant establishes that a controller is processing data in a way that engages GDPR obligations, the controller must then demonstrate compliance.","Irish High Court rules on GDPR burden of proof in ICCL v Microsoft Ireland case.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=High_Court_-_2026_IEHC_640&diff=53287&oldid=53284","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-05T08:06:31+00:00","2026-10-05T10:00:08.719374+00:00",7,[17,20],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Xandr","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":49,"vendors":124},[50,79,107],{"slug":51,"name":52,"problem":53,"products":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":80,"name":81,"problem":82,"products":83},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":101,"vendor_name":18,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":108,"name":109,"problem":110,"products":111},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[112,118],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":120,"url":122,"description":123},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[125],{"slug":101,"name":18,"logo_path":102,"roles":126},[127],"affected",{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":144},"irish-high-court-shifts-compliance-burden-to-microsoft-in-gdpr-real-time-bidding-case","Irish High Court Shifts Compliance Burden to Microsoft in GDPR Real-Time Bidding Case","The Irish High Court's ruling clarifies that once a data subject or representative body demonstrates that a controller is processing personal data in a way that engages GDPR obligations, the burden shifts to the controller to prove compliance — not the other way around. Microsoft's Xandr real-time bidding platform is alleged to have violated GDPR by sharing personal data with thousands of advertisers without adequate legal basis or transparency. This case highlights that ad-tech ecosystems, which rely on mass automated data sharing, carry significant regulatory exposure that organisations often underestimate. The ruling matters broadly because it makes it operationally harder for controllers to rely on procedural ambiguity as a defence, effectively raising the bar for demonstrable compliance across all data processing activities.",[133,134,135,136,137,138,139,140,141,142,143],"GDPR Article 5 (Principles of data processing)","GDPR Article 13 & 14 (Transparency obligations)","GDPR Article 24 (Responsibility of the controller)","GDPR Article 25 (Data protection by design and by default)","GDPR Article 30 (Records of processing activities)","GDPR Article 83 (Administrative fines)","NIST Privacy Framework PR.DS-P4 (Data processing management)","NIST SP 800-53 PT-1 (Personally Identifiable Information Processing and Transparency Policy)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701:2019 (Privacy Information Management System)","ITIL Service Management — Supplier Management Practice",{}]