Microsoft faces lawsuit over allegations of unlawful data processing for advertising

Irish Examiner

8 hours ago

Microsoft Ireland Operations is being sued in the first ever High Court representative action under new legislation over its alleged unlawful processing of personal data which generates billions in advertising revenue.
The Irish Council for Civil Liberties (ICCL) has brought the action claiming Microsoft operates an advertising business, through its Xandr platform, which allows it to sell advertising slots to individual advertisers in a real-time bidding system for a fee.
It is claimed that Microsoft's "search and news advertising" business generated some $10.2bn (€8.6bn) in the nine months ending March 2025.
The ICCL is seeking declarations and orders against Microsoft Ireland Operations Ltd directing it to cease such data processing and/or adjust its processing to comply with GDPR and Irish law.
In May, the ICCL obtained High Court approval deeming its action admissible as a representative action under the 2023 Protection of the Collective Interests of Consumers Act. This is the first such case to be brought under that act.
Fast-track list
On Monday, the case was admitted to the fast track Commercial Court list on the application of James Doherty SC for the ICCL.
Declan McGrath, counsel for Microsoft, said he did not object to the entry of the matter into the list, but he wanted time to write to the ICCL to set out why it is Xandr that should be the defendant and not Microsoft.
Mr McGrath also said his side had separately written to the ICCL about its sources of funding for the proceedings, and that is expected to be provided within a week. Microsoft may have to bring an application in relation to that, he said.
Ms Justice Eileen Roberts said it was a rather unusual case, but one that not only has a commercial aspect but will benefit enormously from the case management jurisdiction of the Commercial Court.
She adjourned it for three weeks, but did not make directions on how it is to proceed to allow the parties to exchange correspondence in relation to funding and the correct defendant.
In an affidavit seeking entry of the case to the commercial list, Johnny Ryan — a senior fellow with the ICCL and director of its privacy and data protection programme Enforce — said the $10.2bn from Microsoft's search and news advertising business was contained in the company's "10-Q" submission to the US Securities and Exchange Commission.
He said further publicly available documents provided by the defendant, which Microsoft claims sufficiently sets out the lawfulness of its processing activities, failed to satisfy the ICCL's concerns.
Mr Ryan said the claim that Microsoft is not the correct defendant is an attempt to delay the prosecution of the proceedings and also delay the vindication of the rights of Irish consumers.
If another party is to be added or substituted as a defendant, Mr Ryan believes this can be done during the currency of the proceedings.