Optus has suffered a further setback in its class action litigation concerning the extensive data breach involving the release of up to 9.5 million customers’ private and confidential information that took place in September 2022. A recent Full Court decision in the Federal Court of Australia by Murphy, Anderson and Neskovcin JJ affirmed a decision by Beach J in that a forensic investigation report drafted by ‘big four’ accounting firm Deloitte (Deloitte Report) for Optus did not attract legal professional privilege and was therefore available to the class action plaintiffs.
This decision provides further guidance as to the legal principles in relation to the commissioning of pre-litigation reports, and a useful reminder to all businesses when seeking such a report to be mindful of the rules in attracting legal professional privilege.
LEGAL PRINCIPLES
The decision of Beach J in Robertson v Singtel Optus Pty Ltd [2023] FCA 1392 delivered on 10 November 2023, articulated the relevant principles in relation to claims for legal professional privilege that was affirmed by Murphy, Anderson and Neskovcin JJ, and not in dispute between the parties, in the appeal decision of Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58 delivered on 27 May 2024 (Appeal Decision).
In summary, under the common law, legal professional privilege applies to confidential communications made for the dominant purpose of the client obtaining legal advice or for use in litigation or regulatory investigations or proceedings. The purpose for which a document was created is a matter of fact to be determined objectively, having regard to the evidence, the nature of the document and the parties’ submissions.
DECISION OF MURPHY, ANDERSON AND NESKOVCIN JJ
The decision of Beach J was broadly upheld in the Appeal Decision on the basis that the Deloitte Report was (1) commissioned for multiple purposes; and (2) not obtained for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory investigations or proceedings.
The primary reasoning in the Appeal Decision was:
- Beach J found, and the Appeal Decision upheld, that Optus had multiple purposes in procuring the Deloitte Report including:
- a legal advice or litigation or regulatory proceeding purpose (the Legal Advice Purpose);
- a purpose more generally to identify the circumstances and root causes of the cyber-attack for management purposes; and
- a purpose of reviewing Optus management’s policies and processes in relation to cyber risk.
- Optus did not adduce focused and specific evidence to establish that the dominant purpose of the Deloitte Report was for the Legal Advice Purpose.
- The evidence of the General Counsel for Optus, that sought to depict that the Deloitte Report was procured for the Legal Advice Purpose, did not sufficiently contextualise non-legal purposes of the Deloitte Report that was observed in the totality of the evidence. In particular, based on Optus’ own media release, it was the CEO who had recommended the Deloitte review to the Board of Optus for multiple purposes. Therefore, the General Counsel’s view alone was not determinative.
- An inference was drawn from the fact that no evidence was given directly by the CEO or Board member of Optus relating to the purpose of the Deloitte review and this failure in evidence reinforced the finding that Optus had not established that the dominant purpose of procuring the Deloitte Report was the Legal Advice Purpose.
KEY TAKEAWAYS
Businesses should take away the following key points from the Appeal Decision if they seek to procure a pre-litigation report for the Legal Advice Purpose, that seeks to attract legal professional privilege:
- Where there are multiple purposes for the procuring of a pre-litigation report, ensure that the decision makers document the primary and other purposes of procuring the report. Alternatively, commission two reports; one for the Legal Advice Purpose and the other for management purposes.
- Note that failing to adduce evidence from decision makers may lead to an inference on the issue by the Court.
The content of this article is intended to provide a general guide to the subject matter. Specific advice should be sought about your specific circumstances.
