Singtel Optus Pty Ltd v Robertson

Singtel Optus Pty Ltd sought leave to appeal against the Federal Court's interlocutory ruling that a report prepared by Deloitte in relation to a cyber-attack on its systems was not protected by legal professional privilege. The primary judge found that Optus had multiple purposes for commissioning the report, including to identify the root cause of the attack and to review its policies and processes in relation to cyber risk, but that there was no evidence to show that the legal advice or litigation purpose was the dominant purpose. Optus argued that the primary judge erred in finding multiple purposes for the report, in assessing the dominant purpose at the wrong time, in identifying the wrong decision-makers, and in failing to draw an adverse inference from the lack of evidence. The Full Court found that the primary judge's judgment was not attended with sufficient doubt to warrant a grant of leave to appeal, and that the primary judge was correct to find that there were multiple purposes for which the report was commissioned and that the evidence did not establish that the report was procured for the dominant purpose of obtaining legal advice or for use in litigation or regulatory proceedings.

The Full Court found that the primary judge had carefully considered the evidence of Optus' General Counsel, Mr Kusalic, but that his state of mind and conduct was only part of the analysis. The primary judge correctly found that the states of mind of the CEO and other board members were also highly relevant to ascertaining the state of mind of Optus given its multiple purposes for procuring the report. The primary judge also correctly examined primary documents and drew appropriate inferences from a consideration of the evidence as a whole. The primary judge found that Optus had multiple purposes including a legal advice or litigation or regulatory proceeding purpose, a purpose more generally to identify the circumstances and root causes of the cyber-attack for management purposes, and a purpose of reviewing Optus management’s policies and processes in relation to cyber risk. The primary judge found, correctly in the Full Court's view, that Optus failed to discharge its onus to show that the legal purpose was the dominant purpose. This was in large part because Optus adduced little evidence as to the predominance of the legal purpose for procuring the report against a background where there existed non-legal purposes, and Mr Kusalic's evidence did not address or even acknowledge the existence of the non-legal purposes shown by the evidence, nor explain or attempt to contextualise the non-legal purposes as opposed to the legal purpose and thereby establish that the legal purpose was Optus' dominant purpose.

The Full Court refused leave to appeal and ordered that the Applicants pay the Respondents’ costs of and incidental to the application.