Singtel Optus Pty Ltd v Robertson

Case [2024] FCAFC 58

FEDERAL COURT OF AUSTRALIA

Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58

Appeal from: Robertson v Singtel Optus Pty Ltd [2023] FCA 1392
File number(s): VID 986 of 2023
Judgment of: MURPHY, ANDERSON AND NESKOVCIN JJ
Date of judgment: 27 May 2024
Catchwords: PRIVILEGE – legal professional privilege – third party report – investigation into cyber-attack – whether the report was created for the dominant purpose of legal advice – multiple purposes for commissioning report – unchallenged evidence – adverse inference – failure to adduce specific and focused evidence – time for assessing dominant purpose
PRACTICE AND PROCEDURE – application for leave to appeal – whether leave to appeal against interlocutory ruling ought to be granted – leave denied
Legislation: Evidence Act 1995 (Cth) s 75
Cases cited:

Ashby v Slipper [2014] FCAFC 15; (2014) 219 FCR 322

Attorney-General (NSW) v Melco Resorts & Entertainment Ltd [2020] NSWCA 40; 102 NSWLR 47; 380 ALR 1

Australian Securities and Investments Commission v Noumi [2024] FCA 349

Australian Securities and Investments Commission v RI Advice Group Pty Ltd [2020] FCA 1277; 148 ACSR 1

AWB Ltd v Cole (No 5) [2006] FCA 1234; 155 FCR 30

Barnes v Commissioner of Taxation (Cth) [2007] FCAFC 88; 242 ALR 601

Browne v Dunn (1893) 6 R 67; 1 WLUK 44

BWO19 v Minister for Immigration, Citizenship, Migrant Services and Multicultural Affairs [2020] FCAFC 181; 283 FCR 299

Choy v Tiaro Coal Ltd (in liq) [2018] NSWCA 205; 98 NSWLR 493; 364 ALR 554; 130 ACSR 475

DBCT Management Pty Ltd v McConnell Dowell Constructors (Aust) Pty Ltd [2021] FCA 512

Ellis v Wallsend District Hospital (1989) 17 NSWLR 553

Friday v Minister for Primary Industry and Resources [2020] FCA 984

Glencore International AG v Commissioner of Taxation [2019] HCA 26; 265 CLR 646

Gwe v Commissioner of the Australian Federal Police [2020] NSWCA 247; 103 NSWLR 509

Hancock v Rinehart (Privilege) [2016] NSWSC 12

Jones v Dunkel (1959) 101 CLR 298

Kennedy v Wallace [2004] FCAFC 337; 142 FCR 185

Kuhl v Zurich Financial Services Australia Ltd [2011] HCA 11; 243 CLR 361

Martin v Norton Rose Fulbright Australia [2019] FCA 1101

Perry v Powercor Australia Ltd [2011] VSC 308

Powercor Australia Ltd v Perry [2011] VSCA 239; 33 VR 548

Precision Plastics Pty Limited v Demir (1975) 132 CLR 362

Quach v MLC Life Ltd (No 2) [2019] FCA 1322

Robertson v Singtel Optus Pty Ltd [2023] FCA 1392

Roberts-Smith v Fairfax Media Publications Pty Ltd (No 23) [2021] FCA 1460; 157 ACSR 438

Singapore Airlines Ltd v Sydney Airports Corporation [2004] NSWSC 380

Sydney Airports Corporation Ltd v Singapore Airlines Ltd [2005] NSWCA 47

Terracom Ltd v Australian Securities and Investments Commission [2022] FCA 208; 401 ALR 143
Division: General Division
Registry: Victoria
National Practice Area: Commercial and Corporations
Sub-area: Regulator and Consumer Protection
Number of paragraphs: 97
Date of hearing: 14 May 2024

Continue reading Singtel Optus Pty Ltd v Robertson

Sign in free to access the full text

Details
AGLC
Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58
Case
[2024] FCAFC 58
Decision Date

CaseChat Overview and Summary

Singtel Optus Pty Ltd sought leave to appeal against the Federal Court's interlocutory ruling that a report prepared by Deloitte in relation to a cyber-attack on its systems was not protected by legal professional privilege. The primary judge found that Optus had multiple purposes for commissioning the report, including to identify the root cause of the attack and to review its policies and processes in relation to cyber risk, but that there was no evidence to show that the legal advice or litigation purpose was the dominant purpose. Optus argued that the primary judge erred in finding multiple purposes for the report, in assessing the dominant purpose at the wrong time, in identifying the wrong decision-makers, and in failing to draw an adverse inference from the lack of evidence. The Full Court found that the primary judge's judgment was not attended with sufficient doubt to warrant a grant of leave to appeal, and that the primary judge was correct to find that there were multiple purposes for which the report was commissioned and that the evidence did not establish that the report was procured for the dominant purpose of obtaining legal advice or for use in litigation or regulatory proceedings.

The Full Court found that the primary judge had carefully considered the evidence of Optus' General Counsel, Mr Kusalic, but that his state of mind and conduct was only part of the analysis. The primary judge correctly found that the states of mind of the CEO and other board members were also highly relevant to ascertaining the state of mind of Optus given its multiple purposes for procuring the report. The primary judge also correctly examined primary documents and drew appropriate inferences from a consideration of the evidence as a whole. The primary judge found that Optus had multiple purposes including a legal advice or litigation or regulatory proceeding purpose, a purpose more generally to identify the circumstances and root causes of the cyber-attack for management purposes, and a purpose of reviewing Optus management’s policies and processes in relation to cyber risk. The primary judge found, correctly in the Full Court's view, that Optus failed to discharge its onus to show that the legal purpose was the dominant purpose. This was in large part because Optus adduced little evidence as to the predominance of the legal purpose for procuring the report against a background where there existed non-legal purposes, and Mr Kusalic's evidence did not address or even acknowledge the existence of the non-legal purposes shown by the evidence, nor explain or attempt to contextualise the non-legal purposes as opposed to the legal purpose and thereby establish that the legal purpose was Optus' dominant purpose.

The Full Court refused leave to appeal and ordered that the Applicants pay the Respondents’ costs of and incidental to the application.

Orders

Orders of the court

1. Leave to appeal be refused.

2. The Applicants pay the Respondents’ costs of and incidental to the application.

Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

Background

Background to the litigation

Full text does not contain this section.

Evidence

Evidence Before The Court

Before the primary judge, Optus sought to discharge its onus to show a privileged purpose was dominant by relying upon the unchallenged affidavit evidence of Mr Kusalic and the inferences which it submitted arise from that evidence. For this reason, we now turn to consider Mr Kusalic’s evidence.MR KUSALIC’S EVIDENCE Mr Kusalic gave evidence that he became aware of the cyber-attack on the morning of 21 September 2022, and formed the view that the incident would "almost certainly" result in regulatory investigations including by the Office of the Australian Information Commissioner (OAIC) and/or the Australian Communications and Media Authority (ACMA), and likely to result in subsequent legal action, including civil penalty proceedings, and also highly likely to lead to one or more class actions against Optus or a representative complaint with the OIAC. He expected there to be a strong customer reaction and ongoing complaints. He said that having regard to the magnitude of the cyber-attack and his expectations of the real likelihood of litigation and regulatory actions it was “immediately evident” to him that Optus would need to engage external lawyers with specific expertise in dealing with such matters: NK [14], [15], [17]-[18], [20]-[21]. Mr Kusalic contacted Ashurst on 22 September 2022, the day after he became aware of the cyber-attack, and Ashurst was retained to advise Optus in relation to the attack: NK [23]-[24]. The same day, Optus announced it had been the subject of a cyber-attack: NK [29]. Within a week, many of the legal threats Mr Kusalic had foreseen were forming (NK [29]-[42]), including that:(a)on 26 September 2022, Slater & Gordon announced they were investigating “a possible class action against Optus on behalf of current and former customers… affected by the unauthorised access to customer data” announced by Optus on 22 September 2022: NK [34];(b)on 28 September 2022, Maurice Blackburn made a similar announcement, and announced on 7 October 2022 that it had lodged a representative complaint with the OIAC: NK [35]-[36];(c)on 11 October 2022, the OIAC announced it had commenced an investigation into the “personal information handling practices” of Optus in regard to the cyber-attack: NK [41]; and(d)on 11 October 2022, the ACMA announced it had commenced an investigation in relation to the cyber-attack: NK [42]. Mr Kusalic:(a)formed the view, soon after the cyber-attack, that in order to assess Optus’ legal risk, it needed to undertake a confidential, forensic investigation into the root cause of the cyber-attack, so that Optus could obtain legal advice from him, his legal team, Ashurst and counsel briefed in the relevant matters: NK [44];(b)formed the view, within about a week after the cyber-attack, that the investigation was best handled by a party external to Optus which had specialist expertise in investigating and reporting on cyber matters: NK [45]-[46];(c)from the outset wanted to ensure that the independent specialist was engaged by Ashurst, and that the scope of the investigation was developed by his legal team in conjunction with Ashurst, so that the investigation and report would assist his team, Ashurst and counsel in advising Optus on the legal risks and regulatory implications arising from the cyber-attack: NK [47]-[49].

Decision

Reasons for decision

It contends that the general rule is that ‘purpose’ is to be assessed at the time that a communication is made, which in the case of a written communication is when the document came into existence, being in this case, 13 July 2023. It argues that the significance of the primary judge adopting the wrong dates is that it caused an improper focus upon evidence the primary judge found did not support the asserted dominant purpose, being the 3 October 2022 media release and the circular Board resolution. Thus, the primary judge found the form of the later main retainer letter could not change the earlier formed dominant purpose at 3 or 11 October 2022: PJ [161].Proposed Appeal Ground 5 – Wrong decision maker On Optus’ submissions, the primary judge also erred by concluding that the appropriate decision makers for the purpose of the dominant purpose test included the Optus CEO and/or the Board: PJ [129]. It contends that where a corporation claims legal professional privilege, it is the corporation’s mind and purpose that is relevant. It says that the corporation’s employees’ state of mind may be attributed to it and where the communication in question is a document, the person whose purpose is relevant will generally be the person who either created the document or caused the document to be created. In this case, Optus submits that the Board’s role was not such that it could be said to be the person who caused the creation of the Deloitte Report, as the Board confirmed an earlier decision made by management. Optus says that, technically, it was Ashurst which retained Deloitte and the evidence demonstrates that Ashurst’s purpose in doing so was to enable it to advise Optus pursuant to its retainer. Optus submits that it is also clear that amongst Optus’ management, from beginning to end, Mr Kusalic was the driving force for engaging Deloitte. Optus submits that if anyone within Optus management could speak to the corporation’s mind concerning the Deloitte Report, it was Mr Kusalic. It notes that Mr Kusalic did so, and his evidence was not challenged.Leave to Appeal Optus submits that the judgment at first instance is attended with sufficient doubt to warrant the grant of leave and the appeal on each of the grounds advanced should be allowed. In addition, it contends that a determination by the Full Court on Ground 3 would provide appellate authority on an issue on which the decision in Terracom Ltd v Australian Securities and Investments Commission [2022] FCA 208; 401 ALR 143 conflicts with the primary judge’s reasons. Finally, it argues that although the case involves questions of practice and procedure, its outcome determines important substantive rights and as such, the restraints to which an appeal court might otherwise submit itself should not be rigidly applied: Choy v Tiaro Coal Ltd (in liq) [2018] NSWCA 205; 98 NSWLR 493; 364 ALR 554; 130 ACSR 475 at [8].CONSIDERATION For the reasons that follow, the primary judge’s judgment is not attended with sufficient doubt to warrant a grant of leave to appeal. Moreover, in our opinion, the primary judge was correct to find on the evidence that there were multiple purposes for which the Deloitte Report was commissioned and that the evidence did not establish that the Deloitte Report was procured for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory proceedings.Proposed Appeal Grounds 1, 3, 4 & 5 – Dominant purpose

Ratio Decidendi

Legal Principle Established

Optus submits that the judgment at first instance is attended with sufficient doubt to warrant the grant of leave and the appeal on each of the grounds advanced should be allowed. In addition, it contends that a determination by the Full Court on Ground 3 would provide appellate authority on an issue on which the decision in Terracom Ltd v Australian Securities and Investments Commission [2022] FCA 208; 401 ALR 143 conflicts with the primary judge’s reasons. Finally, it argues that although the case involves questions of practice and procedure, its outcome determines important substantive rights and as such, the restraints to which an appeal court might otherwise submit itself should not be rigidly applied: Choy v Tiaro Coal Ltd (in liq) [2018] NSWCA 205; 98 NSWLR 493; 364 ALR 554; 130 ACSR 475 at [8].CONSIDERATION For the reasons that follow, the primary judge’s judgment is not attended with sufficient doubt to warrant a grant of leave to appeal. Moreover, in our opinion, the primary judge was correct to find on the evidence that there were multiple purposes for which the Deloitte Report was commissioned and that the evidence did not establish that the Deloitte Report was procured for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory proceedings.Proposed Appeal Grounds 1, 3, 4 & 5 – Dominant purpose Central to Optus’ argument is that the primary judge should have found that the affidavit evidence of Optus’ General Counsel, Mr Kusalic, was conclusive on the question of dominant purpose. The primary judge carefully considered the evidence of Mr Kusalic as being one of the relevant minds but nevertheless found, on the totality of the evidence, that his state of mind and conduct was only part of the analysis. The primary judge found, correctly, that the states of mind of the CEO and the other board members were, on the evidence, also highly relevant to ascertaining the state of mind of Optus given Optus’ multiple purposes for procuring the Deloitte Report. The primary judge also, correctly, examined primary documents and drew appropriate inferences from a consideration of the evidence as a whole. The primary judge found that Optus had multiple purposes including:(i)a legal advice or litigation or regulatory proceeding purpose;(ii)a purpose more generally to identify the circumstances and root causes of the cyber-attack for management purposes;(iii)a purpose of reviewing Optus management’s policies and processes in relation to cyber risk: PJ [120]-[123]. Before the primary judge, Optus did not dispute that the non-privileged purposes in items (ii) and (iii) above existed, but it did not adduce “focused and specific evidence” (Barnes at [18]) to establish that the legal purpose under item (i) was the dominant purpose. The primary judge found, correctly in our view, that Optus failed to discharge its onus to show that the legal purpose was dominant: PJ [3] and [167]. In large part that is because:(a)Optus adduced little evidence as to the predominance of the legal purpose for procuring the Deloitte Report against a background where there existed non-legal purposes; and(b)Mr Kusalic’s evidence did not address or even acknowledge the existence of the non-legal purposes shown by the evidence, nor explain or attempt to contextualise the non-legal purposes as opposed to the legal purpose and thereby establish that the legal purpose was Optus’ dominant purpose.