[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUEEjMfrcnlTKMB1mEtySB-LH2C4wnCSLUJ5uKo0jFD0":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"5b222f63-8709-45dc-91c1-56de27d5a40a","High Court - 2026 IEHC 640","high-court-2026-iehc-640-631c12","Created page with \"{{COURTdecisionBOX |Jurisdiction=Ireland |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=High Court |Court_Original_Name=High Court |Court_English_Name=High Court |Court_With_Country=High Court (Ireland) |Case_Number_Name=2026 IEHC 640 |ECLI= |Original_Source_Name_1=Bilii |Original_Source_Link_1=https:\u002F\u002Fwww.bailii.org\u002Fcgi-bin\u002Fformat.cgi?doc=\u002Fie\u002Fcases\u002FIEHC\u002F2026\u002F2026IEHC640.html&query=(GDPR) |Original_Source_Language_1=English |Original_Source_Language_...\" Show changes","The Irish High Court has ruled on preliminary questions concerning the burden of proof in a representative action brought by the Irish Council for Civil Liberties (ICCL) against Microsoft Ireland Operations Limited regarding the Xandr real-time bidding platform. The court held that while GDPR Articles 5(2) and 24(1) do not generally reverse the burden of proof, once a claimant establishes that a defendant is a controller and that relevant GDPR obligations are engaged, the controller must then prove its compliance.","Irish High Court rules on GDPR burden of proof in representative action against Microsoft.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=High_Court_-_2026_IEHC_640&diff=53281&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-02T08:17:44+00:00","2026-10-02T10:00:19.548949+00:00",7,[17,20],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Xandr","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":49,"vendors":130},[50,78,104],{"slug":51,"name":52,"problem":53,"products":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[55,63,70],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":64,"vendor_name":18,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":79,"name":80,"problem":81,"products":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[83,88,96],{"vendor_slug":64,"vendor_name":18,"vendor_logo":65,"product_slug":84,"product_name":85,"url":86,"description":87},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":105,"name":106,"problem":107,"products":108},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":126,"product_name":127,"url":128,"description":129},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[131],{"slug":64,"name":18,"logo_path":65,"roles":132},[133],"affected",{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":148},"irish-high-court-clarifies-gdpr-compliance-burden-of-proof-for-data-controllers","Irish High Court Clarifies GDPR Compliance Burden of Proof for Data Controllers","The Irish High Court ruled that once a claimant establishes a defendant is a data controller with engaged GDPR obligations, the burden shifts to the controller to prove its own compliance. This case, involving Microsoft's Xandr real-time bidding platform, highlights that data controllers cannot passively assume compliance — they must be able to affirmatively demonstrate it. Real-time bidding ecosystems process vast amounts of personal data at scale, making documented accountability mechanisms essential. The ruling reinforces that GDPR's accountability principle (Article 5(2)) carries real legal weight in litigation and that controllers must proactively maintain and produce evidence of compliance.",[139,140,141,142,143,144,145,146,147],"GDPR Article 5(1) – Principles relating to processing of personal data","GDPR Article 5(2) – Accountability principle","GDPR Article 24(1) – Responsibility of the controller","GDPR Article 30 – Records of processing activities","GDPR Article 35 – Data Protection Impact Assessment","NIST Privacy Framework PR.PO-P1 – Policies and procedures","NIST SP 800-53 PT-1 – Personally Identifiable Information Processing and Transparency Policy","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)",{}]