Strategic litigation is at the core of our advocay work. DRI cases have set landmark precedents for privacy and data protection in Ireland and in Europe. Our case against EU Data Retention laws led to the 2014 ruling by the Court of Justice of the European Union (CJEU) striking down the Data Retention Directive as unlawful. DRI also played a key role in the Schrems cases that reshaped transatlantic data transfers. In Ireland, our court actions have challenged state overreach, including the unlawful expansion of the Public Services Card and the mass collection of biometric data.
The importance and impact of our litigation has been recognised by our international peers in human rights work, including ICCL, EFF, and the Department of Enterprise, Tourism and Employment. We are engaged in ongoing litigation in a number of cases and are looking ahead to new ways to defend civil, human and legal rights in an evolving legal landscape.
Mobile Phone Surveillance
In June 2023, the Department of Justice obtained a High Court order compelling operators to carry out mass surveillance of Irish mobile users and to retain this personal data for Gardaí access. In direct breach of EU law, providers must now store the identity of everyone a customer calls, texts, or emails, along with the precise time and location of each communication, indefinitely.
Status: In response, DRI issued motions in the High Court, which the state responded to by seeking to strike out our actions and avoid the consequences of our historic successful CJEU data retention litigation. Both motions will be heard in the coming term.
Mass Action Lawsuits
In 2025, DRI was designated as one of three Qualified Entities in Ireland able to bring actions on behalf of consumers under the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023. This law introduced a European alternative to class actions for consumers, specifically including those users and customers whose data protection rights have been infringed.
Before this, Ireland had no system for collective redress. Under the Act, individuals no longer need to file and fund separate lawsuits. Instead, DRI can initiate High Court cases and collectively represent EU users affected by data leaks, breaches, or GDPR violations against big tech companies and government bodies.
Status: We are considering suitable cases where we could best use our resources to bring actions on behalf of Europeans whose privacy rights have been breached.