GDPR Accountability: Controllers Must Prove Compliance with Engaged Obligations and Plead Their Positive Defence

1. Introduction

This judgment clarifies how the GDPR’s accountability principle allocates the burden of proof in civil proceedings, including representative actions seeking injunctions. Its central distinction is between proving that a defendant’s GDPR obligations are engaged and proving compliance with those obligations. The claimant must establish the former; where Articles 5(2) and 24(1) require the controller to demonstrate compliance, the controller bears both the legal and evidential burden on that discrete issue.

The decision also establishes an important procedural boundary under the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023. The statutory obligation to provide admissibility information to the court does not give a defendant an independent right to compel additional information. A defendant must instead use an appropriate procedural route, such as challenging admissibility, seeking particulars, or applying for discovery or statutory disclosure.

These were preliminary rulings, not findings that Microsoft Ireland Operations Limited had infringed the GDPR. Whether Microsoft was the relevant controller, whether the challenged processing occurred as alleged, and whether an injunction should issue remained unresolved.

2. Background and Procedural Context

The Irish Council for Civil Liberties Company Limited by Guarantee (“ICCL”), a designated qualified entity, brought a representative action concerning alleged processing of personal data through Microsoft’s Xandr advertising platform. Xandr facilitates real-time bidding: advertising spaces on websites and applications are auctioned almost instantaneously as users access them.

ICCL alleged that bid requests could broadcast highly personal information to advertising-market participants. Its complaints concerned transparency, data minimisation, security and consent. It sought orders requiring Microsoft to cease, amend or restrict the processing. It did not seek compensation or other redress measures under section 26 of the 2023 Act.

On an ex parte application, the High Court had deemed the action admissible and granted permission to commence proceedings. Subsequent exchanges of pleadings produced reciprocal complaints:

• Microsoft alleged that ICCL’s claim was inadequately particularised and depended on vague or speculative assertions.
• ICCL objected to Microsoft’s reliance on denials and non-admissions, arguing that accountability required Microsoft to explain and prove compliance.
• Microsoft also sought further information concerning the action’s funding, the alleged infringements and the affected consumer classes.

Microsoft did not admit that it was the controller of the personal data at issue. ICCL accepted that it bore the burden of establishing that status.

The parties agreed to a preliminary trial. During the hearing, however, it became apparent that their original questions did not accurately capture their disagreement. Both accepted that ordinary Irish pleading rules were sufficiently flexible and compatible with EU law; their real dispute concerned how the allocation of proof affected the application of those rules.

3. The Relevant Statutory Framework

The representative-actions regime

The 2023 Act implements Directive (EU) 2020/1828, the Representative Actions Directive. It allows designated qualified entities to pursue collective consumer interests in relation to specified EU measures, including the GDPR.

• Section 8 governs designation and imposes continuing requirements concerning matters including independence, non-profit status and funding transparency.
• Section 19 governs admissibility. Subsections (10) and (11) require information about funding, the nature of the claim and the affected consumer classes.
• Section 19(5) permits a defendant to raise justified concerns about compliance with designation criteria.
• Section 19(12) permits dismissal of a manifestly unfounded action once the necessary information is available.
• Section 23(7) removes the need to prove individual consumer loss or damage, or the trader’s intent or negligence, when seeking injunctive relief.
• Section 34 provides a reciprocal mechanism for court-ordered disclosure of evidence.

The court stressed that section 23(7) does not reverse the burden of proving damage or fault. Rather, those matters are not necessary proofs for this form of injunction. They may nevertheless remain relevant to the appropriate relief.

The GDPR’s accountability obligations

Article 5(2) makes a controller responsible for, and able to demonstrate compliance with, the processing principles in Article 5(1). Those principles include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and security.

Article 24(1) requires appropriate technical and organisational measures to ensure, and enable demonstration, that processing complies with the GDPR. The court did not need to resolve whether the two provisions differ in the precise scope of their demonstration requirements.

The decisive question was whether these substantive obligations also affect proof in litigation. The court held that they do: when the relevant compliance issue arises, the controller’s obligation to demonstrate compliance carries an associated burden of proving it.

4. Summary of the Court’s Answers

The proceedings were listed for further directions and final orders on the application on 9 October 2026.

5. Legal Reasoning

A. Accountability creates an issue-specific burden, not a presumption against every defendant

The court rejected the proposition that a claimant can simply allege a GDPR breach and require the defendant to disprove the entire claim. A claimant must first establish that the GDPR imposes the relevant obligations on that defendant.

In general terms, this requires proof that the defendant is a controller of personal data and that relevant processing occurs which engages obligations subject to the accountability requirements. Controller status alone is therefore not necessarily sufficient: the processing and the particular duty relied upon must also be identified.

Once those matters are established to the required standard, however, the claimant does not also have to prove non-compliance with an obligation whose compliance the controller must demonstrate. The controller bears the ultimate legal burden, together with the associated evidential burden, on that issue.

This distinction is central. An ordinary evidential shift may arise when a claimant’s evidence is sufficient to succeed unless answered. Here, by contrast, accountability allocates the ultimate risk of failing to establish compliance to the controller. It is not merely a practical incentive to offer rebuttal evidence.

Microsoft characterised Articles 5(2) and 24(1) as substantive obligations unrelated to procedural proof. The court accepted their substantive character but rejected the suggested consequence: a substantive duty to demonstrate compliance necessarily affects who must prove compliance when a court must determine that question.

The judgment nevertheless avoided a universal statement of everything a GDPR claimant must prove. That depends on the processing, obligations and relief involved. Its rule is deliberately issue-specific.

B. Ordinary pleading rules accommodate the GDPR allocation of proof

The parties agreed that the GDPR and the representative-actions regime do not harmonise national pleading rules. Irish rules therefore apply, subject to the EU principles of equivalence and effectiveness. Their compatibility with those principles was not disputed.

Under Order 19, pleadings must state material facts, not the evidence by which those facts will be proved. Further particulars serve to identify the case an opponent must meet, rather than to obtain premature disclosure of every evidential detail.

The GDPR does not dispense with those requirements for ICCL. Equally, a controller cannot rely on the ordinary protection afforded to a bare denial to avoid pleading an affirmative compliance case which it bears the burden of proving.

A defendant may dispute controller status and plead compliance in the alternative. But if it wishes to advance that alternative case positively, it must identify the material facts supporting it. The allocation of proof informs the application of the existing rules; it does not require their replacement.

The court did not decide that every omission would automatically exclude evidence at trial. The consequences of inadequate pleading may depend on judicial discretion and the circumstances, and Issue 1(e) had not been sufficiently argued for an abstract ruling.

C. Admissibility information is supplied to the court, not under a separate defendant disclosure right

Sections 19(10) and 19(11) require information enabling the court to assess admissibility. Their structure indicates that the information must be provided before that assessment. Nothing in either provision creates a separate entitlement for a defendant to demand additional information after the court has accepted what was supplied.

The court distinguished three procedural matters:

1. Designation: section 19(5) permits justified concerns about whether the entity satisfies the designation criteria.
2. Admissibility: a defendant may challenge the admissibility decision, including by seeking to set aside an ex parte leave order.
3. Disclosure: particulars, discovery and section 34(2) may supply information or evidence where their respective requirements are satisfied.

The word “justified” matters. A defendant must identify a proper basis for its concerns; the legislation does not authorise speculative investigation into a qualified entity.

Similarly, an admissibility order made ex parte remains capable of challenge, but it does not require automatic reconsideration. Unless admissibility is properly put in issue, the initial decision stands without needing to be proved afresh during the action.

Information about affected consumers and alleged infringements may be relevant to disputed issues and therefore discoverable. Funding information may also become relevant in an appropriate case, including where conflicts affect admissibility. None of this permits a general trawl for documents.

D. Information asymmetry does not produce an automatic common-law reversal

The peculiar knowledge principle potentially addresses matters beyond one party’s reach and particularly within the opposing party’s capacity to prove. Whether it applies is fact-sensitive.

The court rejected any suggestion that statutory disclosure mechanisms necessarily eliminate the possible operation of a common-law exception. But it equally declined to infer that the exception applied simply because Microsoft possessed information about its own systems.

The agreed facts largely recorded the history of the litigation. They did not establish the underlying processing arrangements or the accessibility of the relevant evidence. Without that foundation, a ruling on the principle’s application would have been inappropriate.

6. Precedents Cited and Their Influence

A. GDPR accountability authorities

SS v Valsts ieņēmumu dienests, Case C-175/20

This case concerned a Latvian tax authority’s demand for information containing personal data. The CJEU held that accountability required the authority to establish that it had minimised the data sought and limited the collection period appropriately. Mulcahy J treated it as a particularly clear illustration: although the recipient challenged the request, the controller had to demonstrate its compliance with data-minimisation requirements.

Meta Platforms, Case C-252/21

The proceedings challenged a German competition authority’s prohibition of certain processing. The CJEU stated that the controller bears the burden of proving relevant aspects of lawful processing. For the High Court, the case showed that a controller invoking necessity to justify processing must establish that justification; the opposing party need not disprove it.

UZ v Bundesrepublik Deutschland, Case C-60/22

In proceedings concerning processing during an international-protection assessment, the CJEU reiterated that the controller must demonstrate compliance with each Article 5(1) principle. Its express placement of that burden on the controller reinforced the High Court’s reading of accountability as carrying consequences for proof, not merely internal record-keeping.

VB v Natsionalna agentsia za prihodite (NAP), Case C-340/21

This was the strongest direct authority concerning civil litigation. Following a cyberattack, a claimant sought damages under Article 82. The CJEU held that the controller had to prove the appropriateness of its security measures under Article 32. Crucially, it described the accountability-based allocation as a rule of “general application”, applicable to Article 82 proceedings absent a contrary indication.

The High Court therefore rejected the argument that accountability’s evidential consequences were confined to regulatory proceedings or that the burden in this case was peculiar to compensation claims.

ZQ, Case C-667/21

Microsoft relied on this contemporaneous Article 82 decision to argue that the relevant reversal concerned fault, rather than infringement. The CJEU had identified infringement, damage and causation as conditions for compensation and explained the controller’s ability to escape liability by proving absence of responsibility.

Mulcahy J did not regard that analysis as contradicting VB v Natsionalna agentsia za prihodite (NAP). A claimant’s overall cause of action may contain several elements without requiring the claimant to prove every compliance question. The distinction between infringement and fault did not displace the separate accountability-based burden.

TikTok v DPC [2026] IEHC 37

Mulcahy J’s earlier judgment concerned international transfers under Article 46. It upheld the regulator’s ability to find an infringement where the controller’s prior assessments failed adequately to demonstrate the required protection.

The present judgment preserved an important nuance: the regulator could retain the overall burden of establishing infringement while discharging it through proof that the controller had failed to demonstrate compliance. Accountability and an overall claimant burden are not necessarily inconsistent. The court expressly noted that TikTok v DPC was under appeal.

Comparative European decisions

In Data Privacy Stichting v Facebook Ireland, 15 March 2023, ECLI:NL:RBAMS:2023:1407, the Amsterdam District Court treated accountability as altering the ordinary Dutch allocation of proof when compliance was properly in issue. The judgment also referred to the Schleswig-Holstein Higher Regional Court’s decision of 24 April 2025, 5 U 59/23, as taking a similar approach in an Article 82 claim.

These references were corroborative, not the principal foundation of the decision. Mulcahy J expressly acknowledged that his account relied on unofficial web-based translations.

B. General proof and effective-remedy authorities

Koger v O'Donnell [2013] IESC 28 explained that an evidential burden may “shift” simply because a party has produced enough evidence to succeed unless answered. The High Court used this authority to distinguish ordinary trial dynamics from the GDPR’s allocation of the ultimate legal burden on compliance.

Hamoudi v Frontex (European Border and Coast Guard Agency), Case C-136/24 P, supplied a wider EU-law perspective. While the Advocate General recognised the general rule that claimants prove their assertions, the CJEU accepted that proof requirements needed adaptation in the particular circumstances of alleged pushback operations to secure an effective remedy under Article 47 of the Charter.

The case demonstrated that the ordinary allocation is not immutable. It did not, however, establish a blanket relaxation for representative GDPR litigation, nor did it supply the missing facts needed to decide the peculiar knowledge issue.

C. Pleading authorities

AIB plc v AIG Europe Limited and Ors [2019] 3 IR 650, [2018] IEHC 677 supplied the principal framework. McDonald J’s analysis connected pleading obligations to the burden of proof: a party ordinarily need not particularise a genuine denial where its opponent alone must prove the disputed matter. However, a denial that substantively advances an affirmative case may require particulars.

That connection was decisive here. Once compliance is a matter the controller must prove, a positive compliance defence must identify its supporting material facts. Mount Salus Residents v An Bord Pleanála [2023] IEHC 691 was cited as adopting a similar analysis.

The judgment reproduced the supporting authorities collected in AIB plc v AIG Europe Limited and Ors:

• Mahon v. Celbridge Spinning Co. Ltd. [1967] I.R. 1 established that a party should know the broad outline of the case it must meet.
• Cooney v. Browne [1985] I.R. 185 distinguished necessary identification of the range of evidence from impermissible demands for particular evidential items. Armstrong v. Moffatt [2013] IEHC 148, [2013] 1 I.R. 417 reiterated that limitation.
• James Elliott Construction Limited v. Lagan [2014] IEHC 547 emphasised that requests for particulars must be genuinely necessary, not oppressive or unreasonable.
• Pinson v. Lloyds and National Provincial Foreign Bank, Ld. [1941] 2 K.B. 72 supported the ordinary rule against particulars of a denial. Warner v. Sampson [1959] 1 Q.B. 297 explained the similar proof-putting effect of denials and non-admissions.
• Weinberger v Inglis [1918] 1 Ch 133 supplied the preferred rationale: the rule reflects the allocation of proof, rather than an absolute proposition that denials contain nothing capable of explanation.
• Moorview Developments Limited v. First Active plc [2005] IEHC 329 established that an opponent’s supposed knowledge of the facts does not excuse a party from stating its own factual case.
• Thema International Fund plc v. HSBC Institutional Trust Services (Ireland) [2010] IEHC 19 recognised that particulars may sometimes appropriately follow discovery and that witness statements can affect the assessment of procedural surprise.
• Quinn Insurance Limited v. PriceWaterhouseCoopers [2015] IEHC 303 similarly recognised the significance of witness statements. Playboy Enterprises International Incorporated v. Entertainment Media Networks Limited [2015] IEHC 102, subsequently approved in Quinn Insurance Limited v. PriceWaterhouseCoopers [2017] IECA 94, recognised the potentially more expansive role of particulars in complex litigation.

Finally, Duffy v. Ridley Properties Ltd. [2008] IESC 23, [2008] 4 I.R. 282 illustrated that a trial court may refuse an unpleaded positive defence. It supported a warning about inadequate pleading, but not an automatic exclusion rule. That distinction explains the refusal to answer Issue 1(e) conclusively.

D. Peculiar knowledge authorities

Mahony v Waterford, Limerick and Western Railway Co. supplied the historical exception for matters peculiarly within a defendant’s knowledge.

Hanrahan v Merck, Sharp and Dohme [1988] ILRM 629, [1988] IESC 1 explained the fairness rationale: a claimant should not have to prove something beyond its reach but particularly within the defendant’s capacity to prove.

Rothwell v MIBI [2003] 1 IR 268, [2003] IESC 16 emphasised that difficulty of proof alone is insufficient. The matter must also be peculiarly within the defendant’s capacity for proof. Neither of those Supreme Court cases actually applied the principle to reverse the burden. Their restrictive, factual approach supported judicial restraint here.

E. Preliminary issues and ex parte orders

Campion v South Tipperary County Council [2015] 1 IR 716, [2015] IESC 79 requires a discrete legal question based on undisputed material facts, with a demonstrable contribution to efficient and fair disposal of the litigation.

LM v Commissioner of An Garda Síochána [2015] 2 IR 45, [2015] IESC 81, together with Craughwell v Government of Ireland [2025] IECA 63, confirmed the court’s continuing discretion not to decide an unsuitable preliminary issue. That discretion underpinned the refusal to determine the peculiar knowledge question.

Re Custom House Capital Ltd [2011] 3 IR 323, [2011] IEHC 298 supported the provisional character of ex parte orders: an affected party must be able to seek reconsideration. It preserved Microsoft’s ability to challenge leave without creating a separate statutory information entitlement.

7. Significance and Potential Impact

More substantive compliance defences

Controllers facing properly grounded claims cannot assume that a generic denial will preserve an affirmative case of compliance. They should identify the relevant processing operations, obligations and supporting material facts. The judgment nevertheless requires facts, not the pleading of every document, technical detail or witness account.

No claimant exemption from factual discipline

Qualified entities must still identify the processing challenged and establish why the defendant is subject to the relevant obligations. The judgment is not authority for issuing an unspecified GDPR claim and demanding a comprehensive compliance audit through litigation.

Nor should it be read as deciding that Microsoft’s refusal to answer ICCL’s pre-action questions automatically established unlawful processing. That was part of ICCL’s pleaded position, not a merits finding.

Controller status may become an important threshold dispute

Because accountability-based proof obligations depend on the defendant being the relevant controller, disputed controller status may assume considerable practical importance. Disclosure may help establish that status, but the claimant’s burden on the issue remains.

A structured approach to funding and admissibility challenges

Defendants retain meaningful safeguards against improperly constituted or unfounded representative proceedings. However, requests concerning funding or consumer classes must be linked to a recognised procedural basis. The ruling limits collateral information demands without immunising qualified entities from justified scrutiny.

Limits of abstract preliminary trials

Mulcahy J considered that the disputes would have been better addressed through concrete applications concerning particular pleadings or disclosure requests. The need to reformulate the questions, and the refusal to answer two of them, illustrate the risk of seeking broad procedural rulings without sufficient agreed facts.

Overall, the decision is an Irish High Court clarification grounded principally in CJEU authority. Its accountability reasoning extends beyond the distinctive representative-action setting, while its holdings on sections 19 and 34 concern the Irish statutory regime.

8. Complex Concepts Simplified

Legal burden of proof

The ultimate responsibility for persuading the court on an issue. In civil proceedings, the usual standard is whether the proposition is more likely than not.

Evidential burden

The responsibility to produce sufficient evidence for an issue to be determined in a party’s favour. It is distinct from the ultimate legal burden.

Accountability

A controller must not only comply with applicable GDPR requirements but also be able to demonstrate that compliance.

Material facts and particulars

Material facts are the essential factual building blocks of a claim or defence. Particulars clarify that case without ordinarily requiring disclosure of all the evidence supporting it.

Ex parte order

An order made without hearing the opposing party. It may be challenged by an affected party, but does not automatically require reconsideration.

Peculiar knowledge principle

A possible exception to ordinary proof rules where a matter is beyond one party’s reach and particularly within the opponent’s capacity to prove. Its application was not decided here.

Equivalence and effectiveness

National procedures must not treat EU-law claims less favourably than comparable domestic claims or make EU rights practically impossible or excessively difficult to enforce.

9. Conclusion

The judgment’s central contribution is a precise allocation of responsibility: claimants must establish that relevant GDPR duties are engaged, while controllers must prove compliance where accountability requires them to demonstrate it. Ordinary pleading rules give effect to that allocation by requiring a positive compliance defence to state its supporting material facts.

The accompanying representative-action ruling is equally disciplined: admissibility information requirements are not a free-standing disclosure jurisdiction for defendants. Properly grounded challenges and established procedural mechanisms remain available.

The decision strengthens accountability without deciding the underlying allegations, dispensing with claimant pleading obligations, or creating an automatic reversal of proof across GDPR litigation.