Robertson v Singtel Optus Pty Ltd

Case [2023] FCA 1392

FEDERAL COURT OF AUSTRALIA

Robertson v Singtel Optus Pty Ltd [2023] FCA 1392

File number: VID 256 of 2023
Judgment of: BEACH J
Date of judgment: 10 November 2023
Catchwords: LEGAL PROFESSIONAL PRIVILEGE – privilege – third party report – investigation into cyber-attack – whether multiple purposes – deficiencies in evidence – common law principles – whether document created for dominant purpose of legal advice – waiver of privilege – privilege claim not made out
Cases cited: Asahi Holdings (Australia) Pty Ltd v Pacific Equity Partners Pty Limited (No 4) [2014] FCA 796
AWB Ltd v Cole (No 5) (2006) 155 FCR 30
Commissioner of Australian Federal Police v Propend Finance Pty Limited (1997) 188 CLR 501
Kirby v Centro Properties Ltd (No 2) (2012) 87 ACSR 229
Mann v Carnell (1999) 201 CLR 1
Osland v Secretary, Department of Justice (2008) 234 CLR 275
Pratt Holdings Pty Ltd v Commissioner of Taxation (2004) 136 FCR 357
Singapore Airlines Ltd v Sydney Airports Corporation [2004] NSWSC 380
TerraCom Ltd v Australian Securities and Investments Commission (2022) 401 ALR 143
Division: General Division
Registry: Victoria
National Practice Area: Commercial and Corporations
Sub-area: Regulator and Consumer Protection
Number of paragraphs: 202
Date of hearing: 14 September 2023
Counsel for the Applicants: Mr W Edwards KC and Ms K Dovey
Solicitor for the Applicants: Slater and Gordon
Counsel for the Respondents: Mr J Sheahan KC, Ms K Richardson SC and Ms E Bathurst
Solicitor for the Respondents: Ashurst

ORDERS

VID 256 of 2023
BETWEEN:

PETER JULIAN ROBERTSON

First Applicant

ELIZABETH GEORGINA FORTUNE

Second Applicant
AND:

SINGTEL OPTUS PTY LTD (ACN 052 833 208)

First Respondent

OPTUS MOBILE PTY LTD (ACN 054 365 696)

Second Respondent

OPTUS INTERNET PTY LTD (ACN 083 164 532) (and others named in the Schedule)

Third Respondent

ORDER MADE BY:

BEACH J

DATE OF ORDER:

10 NOVEMBER 2023

THE COURT ORDERS THAT:

1.Within 7 days of the date hereof the parties file and serve proposed minutes of orders to give effect to these reasons.

2.Liberty to apply.

Note:   Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.


REASONS FOR JUDGMENT

BEACH J

  1. The applicants seek orders for the discovery and inspection of the report prepared for one or more of the Optus respondents by Deloitte Touche Tohmatsu concerning a data breach which occurred in mid-September 2022, the documents prepared for the purpose of providing instructions to Deloitte and all documents provided to Deloitte for the purposes of preparing such a report.

  2. The Optus respondents have asserted legal professional privilege in such material, which privilege the applicants have challenged.  The applicants say that the relevant dominant purpose test has not been satisfied, alternatively they say that there has been a waiver of privilege.

  3. In summary, the Optus respondents have not satisfied me that they satisfy the dominant purpose test.  Clearly they had multiple purposes in procuring the review and report by Deloitte, one of which was a privileged purpose.  But I am not…

Continue reading Robertson v Singtel Optus Pty Ltd

Sign in free to access the full text

Details
AGLC
Robertson v Singtel Optus Pty Ltd [2023] FCA 1392
Case
[2023] FCA 1392
Decision Date

CaseChat Overview and Summary

Robertson v Singtel Optus Pty Ltd concerned a dispute over whether certain documents were subject to legal professional privilege. The case was heard in the Federal Court of Australia. The primary issue was whether a third-party report prepared by Deloitte was protected by legal professional privilege. Optus argued that the report was created for the dominant purpose of providing legal advice regarding the cyber-attack. The court needed to determine if the report was created for multiple purposes, and if the dominant purpose was indeed obtaining legal advice.

The court found that the report was not protected by legal professional privilege. The reasoning was that the report was created for multiple purposes, not just for the purpose of providing legal advice. The court also noted deficiencies in the evidence provided by Optus. The report was found to have been created for purposes such as understanding the technical aspects of the cyber-attack and for regulatory compliance, in addition to legal advice. The court concluded that the dominant purpose was not solely for legal advice, and therefore, the privilege claim was not substantiated. Consequently, the court rejected the privilege claim made by Optus.

The final orders of the court required the parties to file and serve proposed minutes of orders within seven days to give effect to the reasons provided. The parties were also granted liberty to apply for further orders as necessary. The case highlighted the importance of demonstrating that documents are created for the dominant purpose of obtaining or providing legal advice to successfully claim legal professional privilege.

Orders

Orders of the court

1. Within 7 days of the date hereof the parties file and serve proposed minutes of orders to give effect to these reasons.

2. Liberty to apply.

Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

Background

Background to the litigation

Let me begin with some of the facts as disclosed by the evidence before me. I should say that the Optus respondents relied solely on an affidavit from their general counsel and company secretary to support their privilege claim. He was not cross-examined. I should also say that it was not necessary for me to inspect any of the documents the subject of the privilege claim.The relevant facts Between 17 and 20 September 2022, Singtel Optus Pty Ltd (SOPL) and its subsidiaries were apparently the subject of a cyber-attack although of course I am not deciding any question of causation at this stage. From time to time I will refer to these entities collectively as Optus or the Optus respondents depending upon the context. Mr Nicholes Kusalic, general counsel and company secretary of SOPL, became aware of the cyber-attack on 21 September 2022. At that time he formed the view that the number of Optus customers whose personal information was potentially affected by the cyber-attack could have been up to 9.5 million. On and from 21 September 2022, Mr Kusalic formed the view that the cyber-attack would likely lead to one or more regulatory investigations and subsequent litigation. He formed the view that at least the Office of the Australian Information Commissioner (OAIC) would commence an investigation, and that the Australian Communications and Media Authority would possibly also commence an investigation. He considered at the time that these investigations were likely to result in subsequent legal action against Optus, including the seeking of civil penalties. He also considered at the time that the cyber-attack was highly likely to lead to class actions. Indeed, within a week of his becoming aware of the cyber-attack, Mr Kusalic considered a range of potential regulatory and legal actions which might arise out of the cyber-attack, which in addition to regulatory investigations, civil penalty prosecutions and class actions included complaints to the Telecommunications Industry Ombudsman, potential investigations by the ACCC, ASIC and even the threat of a parliamentary inquiry or royal commission. I should say at this point that I accept on the evidence that litigation and legal risks arising out of the cyber-attack were at the forefront of Mr Kusalic’s mind when he first became aware of the cyber-attack. But the question for me is one of analysing various and multiple purposes of the Optus respondents in order to identify the dominant purpose. On 22 September 2022, Optus engaged an external law firm, Ashurst Australia, to provide legal advice and assistance to Optus in relation to the cyber-attack. Ashurst was one of Optus’ panel law firms. They were then engaged to provide legal support and advice on the matter, including any regulatory investigation or class action that arose out of the cyber-attack. Mr Kusalic contacted Mr Nick Mavrakis, a partner of Ashurst, and engaged Ashurst to provide legal advice and assistance to Optus in relation to the cyber-attack.

Evidence

Evidence Before The Court

Full text does not contain this section.

Decision

Reasons for decision

The applicants’ waiver argument must be rejected.Conclusion For the foregoing reasons, in my view the Optus respondents have not made good their claim of privilege concerning the Deloitte report. I will hear further from counsel as to the consequential orders that should be made concerning the relief sought in the applicants’ interlocutory application.

Ratio Decidendi

Legal Principle Established

Full text does not contain this section.