McClure v Medibank Private Limited

Link copied
Case Copied 68 min read

FEDERAL COURT OF AUSTRALIA

McClure v Medibank Private Limited [2025] FCA 167

File number: VID 64 of 2023
Judgment of: ROFE J
Date of judgment: 7 March 2025
Catchwords:

LEGAL PROFESSIONAL PRIVILEGE – third-party reports – investigation into cyber-attack – whether multiple purposes – common law principles – whether documents were created for dominant purpose of legal advice

LEGAL PROFESSIONAL PRIVILEGE – waiver of privilege – implied waiver – whether voluntary disclosure of reports to the regulator was inconsistent with the maintenance of confidentiality in the reports – whether public statements made were inconsistent with the maintenance of confidentiality in the reports

Legislation:

Corporations Act 2001 (Cth)

Evidence Act 1995 (Cth)

Privacy Act 1988 (Cth)
Cases cited:

Asahi Holdings (Australia) Pty Ltd v Pacific Equity Partners Pty Ltd (No 4) [2014] FCA 796

Australian Securities and Investments Commission v Australia and New Zealand Banking Group (No 2) [2020] FCA 1013

Australian Securities and Investments Commission v Macleod [2024] FCAFC 174

Australian Securities and Investments Commission v Noumi Ltd [2024] FCA 349

AWB Ltd v Cole (2006) 152 FCR 382

Commissioner of Australian Federal Police v Propend Financial Pty Ltd (1997) 188 CLR 501

Commissioner of Taxation (Cth) v Pratt Holdings Pty Ltd (2005) 225 ALR 266

Commonwealth Director of Public Prosecutions v Citigroup Global Markets Australia Pty Ltd [2021] FCA 511

Director of Public Prosecutions (Cth) v Kinghorn; Kinghorn v Director of Public Prosecutions (Cth) (2020) 102 NSWLR 72

Esso Australia Resources Ltd v Commissioner of Taxation (1999) 201 CLR 49

Expense Reduction Analysts Group Pty Ltd v Armstrong Strategic Management and Marketing Pty Limited (2013) 250 CLR 303

Glencore International AG v Commissioner of Taxation (2019) 265 CLR 646

Goldberg v Ng (1995) 185 CLR 83

Grant v Downs (1976) 135 CLR 674

Kennedy v Wallace (2004) 142 FCR 185

Macquarie Bank Ltd v Arup Pty Ltd [2016] FCAFC 117

Mann v Carnell (1999) 201 CLR 1

Mitsubishi Electric Australia Pty Ltd v Victorian Workcover Authority (2002) 4 VR 332

Osland v Secretary to the Department of Justice (2008) 234 CLR 275

Pratt Holdings Pty Ltd v Commissioner of Taxation (2004) 136 FCR 357

Precision Plastics Pty Limited v Demir (1975) 132 CLR 362

Robertson v Singtel Optus Pty Ltd [2023] FCA 1392

Roberts-Smith v Fairfax Media Publications Pty Limited (No 23) (2021) 417 ALR 221

Singapore Airlines v Sydney Airports Corporation [2004] NSWSC 380

Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58

State of New South Wales v Betfair Pty Ltd (2009) 180 FCR 543

TerraCom Ltd v Australian Securities and Investments Commission (2022) 401 ALR 143

TerraCom Ltd v Australian Securities and Investments Commission [2022] FCAFC 151

Turner v Bayer Australia Ltd (No 5) (2023) 70 VR 290
Division: General Division
Registry: Victoria
National Practice Area: Commercial and Corporations
Sub-area: Regulator and Consumer Protection
Number of paragraphs: 448
Date of last submissions: 19 February 2025
Date of hearing: 20 May 2024, 23 May 2024, 3 June 2024
Counsel for the Applicants: W A Harris KC, S…
CaseChat AU logo

Keep reading for free

Create a free CaseChat account to read McClure v Medibank Private Limited and more:

  • Read every judgment in full
  • Ask AI and get answers linked to paragraphs
  • See how each paragraph was cited in later cases
  • Download judgments as PDF or Word
Continue with Google

One click creates your free account or signs you in.

By continuing you agree to the Terms and Privacy Policy.

Details
Case
[2025] FCA 167
Decision Date

CaseChat Overview and Summary

McClure v Medibank Private Limited was a case in which the court was required to determine whether certain documents were protected by legal professional privilege. The dispute arose out of a cyber-attack on Medibank, which engaged third-party cyber experts and legal advisors to investigate the incident and provide advice. The central issue was whether the documents created by these experts were protected by legal professional privilege, and if so, whether Medibank had waived that privilege by disclosing some of the documents to regulators and making public statements.

The court had to decide two main legal questions. Firstly, it needed to determine whether the documents in question were created for the dominant purpose of providing legal advice, which would entitle them to legal professional privilege. Secondly, the court had to assess whether Medibank had waived any privilege that might subsist in the documents by voluntarily disclosing them to a regulator or making public statements inconsistent with maintaining their confidentiality.

In addressing these issues, the court found that the documents created by the cyber experts were not primarily for the purpose of providing legal advice, and therefore did not qualify for legal professional privilege. The court held that while the lawyers involved may have used the documents for legal purposes, this did not establish that the documents were created with a legal purpose as their dominant purpose. Additionally, the court concluded that Medibank had waived any privilege that might have applied to some of the documents by disclosing them to a regulator and making public statements that were inconsistent with maintaining their confidentiality.

The court ordered that certain documents were not protected by legal professional privilege, while others were. It also directed the parties to prepare and serve proposed minutes of order to give effect to these reasons and specified that certain parts of the court's reasons for judgment should be redacted before being made publicly available. The court further granted liberty to apply for further orders if necessary.

Orders

Orders of the court

1. Within seven days of the date hereof, the parties file and serve proposed minutes of orders to give effect to these reasons.

2. Until further order, the Court’s reasons for judgment not be disclosed to or published by any person, save to the parties, their legal representatives, and Court staff.

3. Within fourteen days, the parties confer, prepare, and provide to the Chambers of Justice Rofe, proposed redactions to the reasons for judgment. The Court will then prepare a redacted version of the reasons for judgment, which will be made available to the public.

4. In the event the parties are unable to agree to the terms of the proposed minutes of order referred to in order 1 or the proposed redactions referred to in order 3, the areas of disagreement should be set out in mark-up.

5. Liberty to apply.

Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

Background

Background to the litigation

Mr Gatto and Ms Ramsay were not cross-examined. The applicants submit that, to the extent that Mr Gatto and Ms Ramsay depose to the relevant documents having some legal purpose —that was a significant, and perhaps predominant, purpose to them as lawyers. The applicants submitted that, in that sense, Mr Gatto and Ms Ramsay may have used the Cyber Expert Documents for legal purposes — however, this evidence alone does not establish that any legal purposes predominated overall for Medibank. I accept this submission — the singular perspective of lawyers for whom legal purposes are obviously likely to be significant, does not establish, on its own, that any legal purposes predominated overall for Medibank.4. Relevant facts4.1 Standing engagements I note from the outset that Medibank had pre-existing standing engagements with several Cyber Experts and KWM prior to the Cyber Incident. The nature of each standing engagement is outlined below.4.1.1Threat Intelligence Medibank had a standing engagement with Threat Intelligence to act as Medibank’s Digital Forensics and Incident Response (DFIR) partner. As part of its standing DFIR engagement, Threat Intelligence conducted an investigation into the circumstances of the Cyber Incident and conducted dark web monitoring activities to look for evidence of customer data being published on the dark web as well as any other information on the dark web about the Cyber Incident. Threat Intelligence provided a “Digital Forensics and Incident Response Report” to Medibank on 2 December 2022. No claim of legal professional privilege has been made by Medibank in respect of this report or relevant material the subject of Threat Intelligence’s standing DFIR engagement, including the work performed pursuant to these two activities described above.4.1.2Datacom At the time of the Cyber Incident, Medibank had a standing engagement with Datacom to act as Medibank’s primary third-party technology service provider. Following the Cyber Incident, Datacom continued to assist Medibank with IT services, including liaising with other third parties. 4.1.3KWM KWM and Medibank’s relationship is a longstanding one, in place since 1981. The relationship is governed by a “master services agreement” which governs the provision of legal services on all matters subject to any specific, bespoke arrangements agreed for a particular matter. As a matter of practice, KWM does not generally enter into separate retainer agreements with long-standing and key clients like Medibank when it commences to act for them in a new matter. With such clients, the firm’s general practice is to have a “master services agreement” which governs the provision of legal services on all matters subject to any specific, bespoke arrangements agreed for a particular matter. 4.2 Cyber Incident chronology of key events The purpose for which a document was created or commissioned is a matter of law to be determined objectively having regard to the evidence and the nature of the document amongst other things. The Cyber Expert Documents were commissioned, created and delivered at different times. In the case of the Deloitte Reports, some months passed between the initial engagement and delivery of the final reports. I set out below a detailed chronology of key events to provide the context and circumstances surrounding the commissioning and creation of the Cyber Expert Documents which informs my later consideration of whether legal professional privilege subsists in those documents.4.2.111 to 13 October 2022

Evidence

Evidence Before The Court

The evidence in this application was extremely document heavy. In addition to the documents annexed to the respondent’s affidavits, the applicants tendered extensive documents. The applicants provided a useful chronology which helped make sense of the documents by providing a road map as to where they might be found in the various tender bundles and annexures. 3.1 Evidence Medibank has relied upon the purported intentions and respective states of mind of Mr Koczkar, Mr Wilkins and Ms Ramsay to support its contention with respect to dominant purpose. Whilst accepting that there were other purposes for which the Deloitte Reports might be apt, neither Mr Wilkins nor Mr Koczkar strayed from the position that the dominant purpose for which the Deloitte Reports were commissioned was to enable KWM to provide legal advice to Medibank and to assist Medibank in any litigation relating to the Cyber Incident. The evidence of Mr Koczkar and Mr Wilkins at times involved matters of legal characterisation. For example, both witnesses utilised the same legal terms to answer questions in cross-examination and describe the purpose behind several engagements. Portions of the cross-examination which illustrate this are included below.MS HARRIS: You referred to committing to share the outcomes of the review, because those – that the primary of the review was as expressed in this document?MR WILKINS: No. The primary purpose was to get legal advice …MS HARRIS: Now, you have accepted that the legal purpose was not the only purpose of the review; correct?MR WILKINS: No, I don’t accept that, but you asked whether there were other areas that were associated with it or could be associated with it. The answer to that is yes, but the primary purpose was for legal advice. …MS HARRIS: You weren’t simply concerned to make sure that Mr Gatto and his colleagues had adequate information to allow them to provide Medibank with advice?MR WILKINS: That was the primary purpose of the Deloitte commissioning, and understanding what those reports said was important from the board’s perspective to be able to then determine the advice that KWM were providing us.’ Mr Koczkar at times also appeared to minimise any non-legal purpose as ancillary, even at one stage describing “[the] other things that would come out of the review [as] secondary … in my submission”. While I accept that Mr Koczkar and Mr Wilkins hold the views that they expressed, ultimately, the correct legal characterisation is a matter for the Court to determine objectively having regard to the totality of the evidence and cross-examination. As the CEO and Chair of Medibank, their respective states of mind will be highly relevant, but not solely determinative, in the inquiry as to whether legal professional privilege subsists. I elaborate on this further below. Mr Gatto and Ms Ramsay were not cross-examined. The applicants submit that, to the extent that Mr Gatto and Ms Ramsay depose to the relevant documents having some legal purpose —that was a significant, and perhaps predominant, purpose to them as lawyers. The applicants submitted that, in that sense, Mr Gatto and Ms Ramsay may have used the Cyber Expert Documents for legal purposes — however, this evidence alone does not establish that any legal purposes predominated overall for Medibank. I accept this submission — the singular perspective of lawyers for whom legal purposes are obviously likely to be significant, does not establish, on its own, that any legal purposes predominated overall for Medibank.4. Relevant facts4.1 Standing engagements

Decision

Reasons for decision

The statements in the 28 April 2023 ASX Announcement were not casually made, they were consciously and deliberately made following consideration by at least the Board, by way of a formal ASX announcement.9. Conclusion For the reasons set out above I consider that legal professional privilege does not subsist in the three Deloitte Reports (Documents 15, 16 and 17 listed in Annexure A). I consider that the Cyber CX and Coveware Communications (Documents 1, 2, 3, 4, 5, 6, 7, 8 and 9) listed in Annexure A), CrowdStrike Reports (Documents 10 and 11 listed in Annexure A), the Threat Intelligence Reports (Documents 12 and 13 listed in Annexure A) are privileged. At this stage, I will make orders that within seven days of the date hereof the parties file and serve proposed minutes of orders to give effect to these reasons.

Ratio Decidendi

Legal Principle Established

The applicants further submit that Medibank’s public statements are of a different quality to those considered by the Full Court in Singtel Optus. Here, Medibank made the 28 April 2023 ASX Announcement after it had received the PIR Report. As such, there was no ambiguity as to what Medibank was referring.8.3 Consideration8.3.1Provision of Deloitte Reports to APRA The applicants also relied on the finding of an implied waiver in Australian Securities and Investments Commission v Noumi Ltd [2024] FCA 349. There, a PwC report was prepared and provided to ASIC in the circumstance that Noumi had been attempting to cooperate with ASIC’s investigation regarding “unsaleable inventory”. Noumi entered into a “Voluntary Confidential Legal Professional Privilege Disclosure Agreement” (defined as a VDA) with the regulator under which Noumi disclosed various documents (purportedly) covered by privilege at common law, including the PwC report. The Full Court in Macleod recently overturned the finding of an implied waiver on the basis of a “derivative” use of the report by ASIC. The primary judge considered that the PwC report could be used by ASIC to identify witnesses, to examine the topics to be explored with them, the questions to be asked and so on. The Full Court considered that the reference to “derivative use” was a reference to how the contents of the PwC report may be used by ASIC, finding at [147] that such derivative use of information did not amount to a disclosure of that information. To the extent that it might have been, ASIC was prevented by clause 4.1 of the VDA from doing so. The Full Court in Macleod observed at [150] that an information asymmetry between parties does not of itself amount to unfairness in this context. The unfairness that informs inconsistency is forensic unfairness as between the privilege holder and the privilege challenger: Macquarie Bank Ltd v Arup Pty Ltd [2016] FCAFC 117 at [29] (per Middleton, Robertson and Gleeson JJ). The Full Court in Macleod continued at [150]–[151]:Unlike the position on the facts in Goldberg, here, no disclosure was made by Noumi to gain an advantage over the opposing party in related litigation. Indeed at [212] the primary judge explicitly found that there was no such motive in subjective terms. Nor is one apparent in objective terms. Mere relevance of the withheld material does not by itself establish an inconsistency necessary to give rise to an implied waiver; Kinghorn at [151]. To the extent that investigations and admissible evidence obtained informed the formulation by ASIC of a case against Mr Macleod, he was entitled to access such material as might be deployed against him in the case in the course of normal pre-trial processes. Whether unfairness is considered at the time of the disclosure of the privileged material (here, on 19 October 2020) or at the time the claim for privilege is made by Noumi (13 September 2023), it may be assumed that ASIC and Noumi were aware that such pre-trial processes would make information of the kind considered above available to Mr Macleod.