A legal milestone has been reached in Ireland as the High Court has permitted the Irish Council for Civil Liberties (ICCL) to move ahead with collective legal action against Microsoft, marking a pivotal moment in the ongoing push to hold tech companies accountable for alleged misuse of personal data.
The ICCL, invoking the recently enacted Protection of the Collective Interests of Consumers Act 2023, is stepping in on behalf of Irish consumers whose personal information, it argues, has been misused through Microsoft’s real-time bidding system used in digital advertising.
This process, according to the ICCL, involves the large-scale dissemination of user profiles to numerous advertisers, raising the alarm over whether individuals have knowingly consented to such widespread data exposure.
Justice Barry O’Donnell approved the ICCL’s request to proceed with what’s known as a representative action, a legal mechanism that allows qualified bodies to sue in the public interest on behalf of affected individuals.
In his remarks, the judge acknowledged that this appears to be the first time such a framework has been employed in the Irish courts. He emphasized that the order was made in the absence of Microsoft’s legal team, who retain the right to challenge the decision later.
The ICCL has also been authorized to formally serve legal papers to Microsoft as it seeks injunctive measures aimed at halting certain data processing activities.
These measures, if granted, would restrict Microsoft from continuing to handle specific categories of personal information linked to targeted advertising.
The group’s legal filings express concern over how Microsoft’s advertising operations might be infringing upon the rights of Irish users, particularly through the use of technologies such as Xandr.
These services reportedly operate across a suite of platforms and products including Xbox, Windows, Office’s web-based tools, and the Edge browser, as well as third-party websites and apps integrated with Microsoft’s advertising ecosystem.
The ICCL’s core allegation is that Microsoft’s system “broadcasts” personal profiles to “large numbers” of advertisers as part of the real-time ad auction process. This, they argue, poses serious questions about the validity of user consent and the transparency of data handling practices. According to the ICCL, consumers may not be fully aware of “the breadth of the processing of their personal data undertaken by Microsoft.”
By launching this legal challenge, the ICCL aims to curb what it views as unchecked data exploitation and reinforce the rights enshrined under GDPR and Irish data protection law. The case now sets the stage for a broader examination of how personal data is commodified in the digital ad economy and whether tech giants are living up to their legal responsibilities in doing so.
