Irish Council For Civil Liberties Company Ltd By Guarantee v Microsoft Ireland Operations Ltd (Approved)

Factual and Procedural Background

The Plaintiff, a qualified entity, brought a representative action alleging that the Defendant infringed the GDPR through processing personal data on an online real-time bidding platform. The Plaintiff seeks injunctive relief under section 23 of the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023. [1][2][3][4]

The High Court initially deemed the proceedings an admissible representative action and granted leave to issue proceedings. The parties subsequently exchanged pleadings and disputed the adequacy of each other’s case: the Defendant challenged the Plaintiff’s particulars, while the Plaintiff objected to denials and non-admissions in the defence. [5][6][7][8][9][10]

The parties agreed to a preliminary trial concerning the burden of proof, pleading obligations, the “peculiar knowledge principle”, and the Defendant’s entitlement to seek information concerning admissibility under the 2023 Act. [11][12][13][14]

Legal Issues Presented

1. Whether Articles 5(2) and 24(1) GDPR alter or reverse the legal or evidential burden of proof, and how they affect the parties’ pleading obligations. [15][16][17][18][19]
2. Whether the Defendant must positively plead facts supporting an alternative case that it complied with its GDPR obligations, and what consequences might follow from failing to do so. [18][19]
3. Whether the “peculiar knowledge principle” reverses the legal or evidential burden of proof. [20][14]
4. Whether the Defendant may seek further information concerning funding, the nature of the alleged infringement, and the affected consumer classes under sections 19(10) and 19(11) of the 2023 Act. [21][13]

Arguments of the Parties

Plaintiff's Arguments

• The Plaintiff accepted that it bore the burden of proving that the Defendant was the relevant data controller and of establishing a prima facie case that processing infringed the GDPR. [22]
• Once that threshold was met, the Plaintiff argued that the Defendant bore the burden of proving compliance with the GDPR and had to plead the material facts supporting such compliance. [23][22][24]
• The Plaintiff argued that the relevant information was within the Defendant’s exclusive knowledge and that the “peculiar knowledge principle” therefore applied. [25]
• The Plaintiff contended that the Defendant had no free-standing entitlement to obtain more information under sections 19(10) and 19(11), absent a challenge to the admissibility order. [26][27]

Defendant's Arguments

• The Defendant argued that the Plaintiff retained both the legal and evidential burden throughout and that there was no general reversal of the burden of proof. [24]
• It submitted that Articles 5(2) and 24(1) GDPR imposed substantive obligations, not rules governing pleading or the burden of proof in civil proceedings. [28]
• The Defendant relied on section 23(7) of the 2023 Act and section 34 as mechanisms addressing proof and information asymmetry, arguing that no further procedural adaptation was required. [24]
• It argued that it should be able to revisit the ex parte admissibility order and that the information supplied about affected consumers was inadequate to enable it to defend the proceedings. [29]
• It relied on sections 19(5) and 19(12) of the 2023 Act as supporting its entitlement to raise concerns regarding designation and admissibility. [30]

Table of Precedents Cited

Court's Reasoning and Analysis

The Court held that the ordinary national rules of pleading apply to both parties and are consistent with the principles of equivalence and effectiveness. Each party must plead the material facts on which it relies. [84][85][86][87][88][89]

The Plaintiff bears the initial legal and evidential burden of proving that the Defendant is a data controller and that personal data is being processed in circumstances engaging the GDPR. There is no general rule requiring a defendant to prove that it has not infringed the GDPR. [90][91][92]

However, Articles 5(2) and 24(1) GDPR impose substantive obligations on a controller to demonstrate compliance. Once the Plaintiff establishes the matters necessary to engage a specific GDPR obligation, the Defendant bears both the legal and evidential burden of proving compliance with that obligation. This is an ultimate burden, not merely a practical evidential shift. [55][56][64][93][94][50]

If the Defendant relies affirmatively on compliance as a defence, it must plead the material facts supporting that case. The Court declined to decide in the abstract whether failure to do so would automatically prevent the Defendant from presenting those facts at trial, because the issue had not been fully argued and may depend on the circumstances. [95][32][96][97][98]

The “peculiar knowledge principle” was not determined. The Court considered that its application is fact-sensitive, and the agreed facts did not provide a sufficient factual basis for deciding whether the principle applied. [77][80][81][82][53]

Sections 19(10) and 19(11) require information to be provided to the Court for the purpose of assessing admissibility. They do not create a standalone right for a defendant to compel further information after the Court has already made an admissibility order. [99][100][101]

The Defendant may nevertheless challenge admissibility, seek to set aside the ex parte order, request particulars, or seek discovery or disclosure under section 34(2), provided the relevant procedural requirements are met. A general trawl for documents is not permitted. [76][102][103][104][105][106]

Holding and Implications

PARTIALLY DETERMINED: The Court held that there is no general reversal of the burden of proof. The Plaintiff must establish the matters engaging the GDPR, but the Defendant bears the legal and evidential burden of proving compliance with specific GDPR obligations once those obligations are engaged. [107][108][109]

The ordinary pleading rules apply to both parties, and the Defendant must plead the material facts supporting any positive compliance defence. [110][111][112]

The Defendant has no standalone entitlement under sections 19(10) and 19(11) to compel further admissibility information, but may use other available procedures, including a challenge to the admissibility order, particulars, discovery, or section 34(2) disclosure. [113]

The Court declined to determine the issue concerning the consequences of failing to plead compliance facts and the issue concerning the peculiar knowledge principle. Further directions and final orders on the application were listed for a later date. [114][115]