ICCL launches representative-action GDPR lawsuit in Ireland against Microsoft

The Irish Council for Civil Liberties (ICCL) has received High Court approval in the country to proceed with a class action lawsuit against Microsoft. The ICCL claims that Microsoft is violating EU General Data Protection Regulation (GDPR) rules, along with Ireland's Data Protection Act 2018, through its real-time bidding (RTB) system for online advertising. The lawsuit marks the first representative action of its kind to be brought before the Irish courts under the recently enacted Protection of the Collective Interests of Consumers Act 2023, which allows qualified entities, such as the ICCL, to bring proceedings on behalf of groups of consumers.

The ICCL argues that Microsoft's RTB system improperly processes and "broadcasts" personal data, creating "profiles" of individual data subjects to a large number of prospective advertisers. This practice, according to the ICCL, raises serious questions about whether individuals are truly consenting to such widespread and potentially unsecured sharing of their personal data or if they are even fully aware of the extent of Microsoft's data processing activities. The ICCL is seeking injunctive reliefs, including orders to restrain Microsoft from processing certain categories of personal data.