The Full Federal Court has now twice refused leave to appeal against findings that third party forensic investigation reports commissioned in the wake of major cyber incidents were not protected by legal professional privilege.
In Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58 and Medibank Private Limited v McClure [2026] FCAFC 38, the Court has sent a clear message as to the importance, in relation to third party engagements, of having focused and specific evidence that the relevant dominant purpose was the ruling, prevailing or most influential purpose for which the report (and other associated records) was brought into existence.
Optus
In September 2022, Optus suffered a significant cyber-attack that compromised the personal data of up to 9.5 million customers. Optus' General Counsel immediately recognised the legal risks and retained Ashurst to advise on Optus’ legal exposure. A forensic investigation by Deloitte was commissioned, ultimately through Ashurst, to report on the root cause of the cyber-attack.
Optus claimed privilege over the Deloitte report. The primary judge found that Optus had three distinct purposes in procuring the report, being a legal advice purpose, a purpose of identifying the root cause for management and rectification, and a purpose of reviewing Optus' cyber risk policies and processes. Optus had failed to discharge its onus of establishing that the legal purpose was dominant.
The Full Court refused leave to appeal and made the following key observations:
- Subjective evidence is not determinative. The evidence of the intention of the person who made or procured a document is not conclusive of purpose.
- Purpose of other stakeholders. The states of mind of the CEO and the Board (not just the General Counsel) were highly relevant to ascertaining the state of mind of Optus, given Optus had multiple purposes for procuring the report. No board members gave evidence. The General Counsel’s evidence supported the legal purpose behind commissioning the report but did not address or contextualise the non-legal purposes.
- Importance of contemporaneous documents. Optus’ media releases attributed statements to the CEO as to the purposes of the Deloitte report, including understanding how the attack occurred, preventing recurrence, and rebuilding customer trust. None of these statements concerned a legal purpose. Similarly, the Board's circular resolution did not mention any legal purpose.
Medibank
In late 2022, Medibank experienced a cyber incident in which customer data was exfiltrated. Medibank’s General Counsel engaged King & Wood Mallesons, which in turn retained Deloitte to conduct an external review. Privilege was claimed over three Deloitte reports, being a Post Incident Review, a Root Cause Analysis, and a CPS 234 Compliance Report (Deloitte Reports).
The primary judge found that the Deloitte Reports served multiple substantial purposes beyond legal advice, including regulatory, governance and public accountability functions, and that Medibank had not established that the legal purpose was dominant.
Like with Optus, the Full Court refused leave to appeal and made the following key observations:
- A corporations purpose can differ from individual purposes. Even if the deposing witnesses honestly believed that the Deloitte Reports had a predominantly legal purpose, the objective circumstances showed that legal purpose did not predominate overall. The corporation’s objective purpose can also be determined as disclosed by its contemporaneous acts and documents. For example, with Medibank, the board, the cyber response committee, the executive leadership team, the external affairs function, the legal team, risk and governance personnel, technical consultants and regulators were all likely to shape the practical work done.
- Retainer language is not definitive. A solicitor retainer for a non-lawyer expert may be a strong indicator that the legal purpose predominates. However, the Court looks beyond the retainer language to the practical and institutional role the document was intended to play.
- Public statements can illustrate purpose. Medibank's ASX announcement that the review would "ensure that we learn from this event and continue to strengthen our ability to safeguard our customers" was treated as strong evidence of purpose at the time of commissioning.
Key lessons for lawyers and clients
Both Optus and Medibank make clear that a claim for privilege will not succeed on generalised evidence. Nor will explanations after the fact be conclusive as to the dominant purpose. It is therefore critical that contemporaneous records demonstrate that the commissioning of a third party report was predominantly for a privileged purpose.
Engagement letters can go further than merely stating the dominant purpose
While Medibank makes clear that retainer language alone is not determinative, it remains an important factor. The lesson is not that engagement letters do not matter, but rather that they must be part of a broader and consistent body of evidence.
Engagement letters largely do state that the dominant purpose of the engagement is for legal advice and/or litigation. But they rarely go further than that in explaining why that is the case. Engagement letters may be aided with the addition of words to the following effect:
The parties acknowledge that while there are various other matters for which any subsequent report may be of use, the report is ultimately commissioned for the dominant purpose of providing legal advice [to client] in relation to [describe the legal matter]. This report would not be commissioned but for that dominant legal purpose.
The final sentence is intended to capture the statement from Kenny J in Commissioner of Taxation (Cth) v Pratt Holdings Pty Ltd [2005] FCA 1247 at [30(8)], being that if the decision to bring the document into existence would have been made irrespective of any purpose of obtaining legal advice, the latter purpose cannot be dominant.
This formulation serves two functions. First, it records a contemporaneous acknowledgement by both parties of the dominant purpose. Second, it employs the "but for" formulation to establish that the report's creation is driven by the legal need, even where other purposes co-exist.
Of course, such wording is not definitive proof that the dominant purpose of the engagement was indeed for a privileged purpose. As Lee J observed in Medibank,privilege is a matter of substance, not drafting. But it is a factor that ought to assist in determining what the dominant purpose of an engagement was.
Aligning all stakeholders with the dominant purpose
In determining privilege claims, courts will scrutinise the entire documentary record, including media releases, board resolutions, ASX announcements, governance frameworks, communications with regulators and internal documents. As Optus and Medibank show, even though the dominant purpose of the lawyers or the instructors of the client when commissioning a third party report may have been a legal purpose, that was not necessarily the corporation’s purpose.
The message is clear: if a report is intended to be commissioned for the dominant purpose of legal advice or litigation, the contemporaneous documents should say so, or at the very least, should not point in the opposite direction.
That purpose should be understood by the organisation as a whole. Where this becomes particularly problematic is public communications, where the fact of the investigation or report is described as being for various other non-legal purposes.
It is not necessary for public statements to refer to a dominant privileged purpose. But public statements should be carefully drafted so as not to characterise the purpose of the review in terms that are inconsistent with establishing a dominant legal purpose. And while public statements about an incident may be reputationally desirable, care must be taken on what is said.