Dr Johnny Ryan

The legal action, brought under the new EU Collective Redress Directive, alleges that the “real-time bidding” (RTB) system used by Microsoft to serve targeted online advertising is incompatible with the EU General Data Protection Regulation (GDPR).

The application on behalf of all affected people in Ireland was timed to coincide with the seven-year anniversary of the GDPR’s introduction on 25 May 2018.

The outcome of the litigation is anticipated to affect Microsoft’s operations across the European Economic Area (EEA) as the company’s European headquarters are based in Ireland.

Dr Johnny Ryan, director of ICCL’s Enforce unit, said: “People’s intimate secrets such as their relationship, work and financial status are broadcast by Microsoft into the real-time bidding advertising system.

“That system is a black hole of data open to any malicious actor and represents a huge data breach of millions of people’s information.”

ICCL Enforce says it has posed as a data buyer and obtained thousands of RTB data “segments” about Irish people.

These, it says, include information such as whether a person gambles, their finances and debt, and even such sensitive information as whether the person works in a sensitive national security role.

Dr Ryan said: “Microsoft has no way of knowing what happens to the personal data after it broadcasts. This a data breach, pure and simple.

“Microsoft is exposing us all individually to malicious profiling and discrimination, and in doing so it is also undermining European security.”

ICCL is represented in the litigation by James Doherty SC, Sean O’Sullivan BL and Ahern Rudden Quigley.