High Court - 2026 IEHC 640
Irish High Court rules on GDPR burden of proof in representative action against Microsoft.
The Irish High Court has ruled on preliminary questions concerning the burden of proof in a representative action brought by the Irish Council for Civil Liberties (ICCL) against Microsoft Ireland Operations Limited regarding the Xandr real-time bidding platform. The court held that while GDPR Articles 5(2) and 24(1) do not generally reverse the burden of proof, once a claimant establishes that a defendant is a controller and that relevant GDPR obligations are engaged, the controller must then prove its compliance.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Irish High Court ruled that once a claimant establishes a defendant is a data controller with engaged GDPR obligations, the burden shifts to the controller to prove its own compliance. This case, involving Microsoft's Xandr real-time bidding platform, highlights that data controllers cannot passively assume compliance — they must be able to affirmatively demonstrate it. Real-time bidding ecosystems process vast amounts of personal data at scale, making documented accountability mechanisms essential. The ruling reinforces that GDPR's accountability principle (Article 5(2)) carries real legal weight in litigation and that controllers must proactively maintain and produce evidence of compliance.
What helps against this
How we list vendors
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.