Optus Data Breach: Optus’ fight over internal Deloitte report found to be “meritless”

_{< Go back to Class Actions Landscape Australia}

This judgment concerned an application for orders for the discovery and inspection of a report prepared by Deloitte for the Optus respondents in relation to the September 2022 data breach (Deloitte Report), including the documents prepared for the purpose of providing instructions to Deloitte and all documents provided for the purposes of preparing such a report. The respondents asserted legal professional privilege over the relevant materials, which privilege the applicants challenged on the basis that the relevant ‘dominant purpose’ test had not been satisfied, or alternatively, there had been a waiver of privilege.

Ultimately, his Honour was not persuaded that the 'dominant purpose' test had been satisfied. The report was said to have been procured for multiple purposes, including a privileged purpose, however this latter purpose did not satisfy the requisite 'dominant purpose' test. In respect of any waiver of privilege (had the 'dominant purpose' test been met), his Honour found the applicants' position to be ‘meritless’ and accepted that there has been no waiver of privilege.

Legal Professional Privilege

As the dispute related to pre-trial disclosure and not the adducing of evidence, his Honour determined the issues by reference to common law principles as distinct from s 118 of the Evidence Act 1995 (Cth). Under the common law, legal professional privilege applies to confidential communications made for the dominant purpose of the client obtaining legal advice or for use in litigation or regulatory investigations or proceedings. The protection is confined to confidential communications made for the dominant purpose of giving or obtaining (including preparation for obtaining) legal advice or the provision of legal services, including legal representation in litigation or other proceedings.

The relevant principles in respect of claims for privilege are extracted in full at [88], which are summarised (non-exhaustively) by his Honour as follows:

1. the purpose for which a document was created is a matter of fact to be determined objectively, having regard to the evidence (which must be focused and specific as distinct from generalised, opaque or repetitive verbal formulae or assertions), the nature of the document and the parties' submissions;
   
   
2. evidence of the intention of the person who made the document, or the person who authorised or procured it, is not conclusive of purpose. In many instances, it is the character of the document(s) over which privilege is asserted that will illuminate purpose; and
   
   
3. it is not sufficient to show a substantial purpose or that the privileged purpose is one of two or more purposes of equal weighting; rather it must predominate, and be the paramount or most influential purpose.

Having regard to the above, and following a detailed consideration of the circumstances surrounding the creation of the Deloitte Report, his Honour found that the respondents had failed to discharge the onus of establishing their claim of privilege. Instead, on the evidence there were a ‘multiplicity of purposes' evinced across key documents (including board resolutions, media releases and terms of engagement), which included generally to identify the circumstances and root cause(s) of the cyber-attack for management purposes, and rectification and reviewing the respondents’ management of cyber-risk in relation to its policies and processes.

His Honour was particularly critical of the evidence led by the respondents, his analysis being fortified by the vagueness of the evidence of its general counsel, the ‘uncomfortable sense’ that important aspects of the evidence ‘involved an element of reconstruction’, and the absence of evidence from chief executive officer, Kelly Bayer Rosmarin, or any member of the board (leading to a Jones v Dunkel point that “[wa]s not without merit”).

Waiver of Privilege

In the alternative, and as was rejected by his Honour, the applicants argued that should his Honour find the Deloitte Report to be privileged, that privilege had been waived. Broadly, it was submitted there was an inherent inconsistency in the respondents relying upon the Deloitte Report in these ways whilst it was in the midst of a public relations crisis, and subsequently seeking to rely upon privilege in trying to resist any inspection of the report itself and its underlying material.

An implied waiver occurs where there is some inconsistency between the conduct of the privilege holder and the maintenance of the confidentiality which the privilege is intended to protect. The relevant inquiry to be undertaken is a fact-based inquiry as to whether by conduct the privilege holder has directly or indirectly put the contents of an otherwise privileged document in issue, and entails an evaluative decision based on a consideration of the whole of the circumstances of the particular case.

Having regard to the circumstances of the case, his Honour was not persuaded that the public statements referred to by the applicants put the contents of the otherwise privileged report in issue and, therefore, there had been no meaningful disclosure of the substance of Deloitte's views or advice or any public deployment of the gist thereof.

Robertson v Singtel Optus Pty Ltd [2023] FCA 1392

Federal Court of Australia, Beach J,
10 November 2023

Applicants’ Solicitors: Slater & Gordon
Respondents’ Solicitors: Ashurst
Applicants’ Funder: N/A

Austii link

_{< Go back to Class Actions Landscape Australia}