The Full Court of the Federal Court of Australia affirmed a first-instance decision finding that a forensic investigation report prepared by Deloitte following a cyber-attack on Optus was not privileged. The Full Court held that the report was commissioned by Optus for multiple purposes and that the evidence did not establish that it was procured for the dominant purpose of obtaining legal advice or for use in litigation or regulatory proceedings.

This decision provides useful guidance about the relevant principles applicable to claims for legal professional privilege, the dominant purpose test, and the evidence that may be required in a corporate context to establish the dominant purpose for which a document was created.

Key takeaways

• Legal professional privilege applies to confidential communications and documents made for the dominant purpose of the client obtaining legal advice or for use in litigation or regulatory investigations or proceedings.
• Where a document or communication has been prepared for multiple purposes, the party asserting privilege must discharge its onus of establishing the dominant purpose by adducing focussed and specific evidence to establish that the dominant purpose for which the document was created, or communication was made, was for a legal purpose. 
• Evidence of the intention of the person who made, authorised or procured the document is not conclusive. It will be insufficient to show a substantial purpose or that the privileged purpose is one of two or more purposes of equal weighting. The privileged purpose must be the predominant or paramount or most influential purpose.
• Courts will consider a variety of evidence to assess the dominant purpose for which a document or communication was made, including public statements and/or media releases made by a company. An unsupported assertion cannot establish a dominant purpose.
• It is open to a Court to draw a Jones v Dunkel inference in the context of a party’s claim for privilege.
• The date upon which to assess the purpose will depend on the circumstances of each case. Although in many cases where a report has been commissioned from a third-party provider, the relevant time to assess the party’s purpose for doing so “will be at the time of commissioning” the report, in other cases, it will be necessary for the Court to assess the purpose across the continuum of time leading up to the creation of the report.

Recap of the first instance decision in Robertson v Singtel Optus

The first instance decision in Robertson v Singtel Optus Pty Ltd [2023] FCA 1392 (First Instance Decision) concerned a class action against Singtel Optus Pty Ltd and its subsidiaries (Optus) in connection with a widespread cyber-attack and data breach that occurred in 2022, affecting millions of Australians. 

Deloitte was retained by Optus to prepare a report into the “root cause of the cyber-attack and Optus’ response to it” (Deloitte Report). The applicants to the proceedings sought orders for the discovery and inspection of, among other things, the Deloitte Report. Optus asserted legal professional privilege in the report, which the applicants challenged. Given the dispute between the parties concerned pre-trial disclosure, the primary judge, Beach J, determined the dispute by reference to common law principles.

Justice Beach held that the Deloitte Report was not protected by legal professional privilege primarily because Optus had not established that the Deloitte Report was prepared for the dominant purpose of obtaining legal advice. Rather, his Honour found the report was prepared for multiple purposes not all of which were connected with legal advice. His Honour also found that Optus’ Board resolutions did not support the contention that the Deloitte Report was protected by legal professional privilege. 

Our article on the First Instance Decision is available here: Federal Court rejects Optus's privilege claim over Deloitte report.

The appeal

The Full Court (Murphy, Anderson and Neskovcin JJ) held that Beach J correctly found that the Deloitte Report was:

1. commissioned for multiple purposes, which included both legal and non-legal purposes; and
2. not procured for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory proceedings. 

Optus’ grounds of appeal

On appeal, Optus argued that the primary judge:

1. Erred by not finding that, “the Deloitte Report had been created for the dominant purpose of enabling Optus to obtain legal advice, or for the provision of legal services to Optus for the purpose of actual or anticipated legal proceedings”;
2. wrongly assessed Optus’ purpose in procuring the Deloitte Report at the time when Optus published a media release stating it was appointing Deloitte to conduct an independent external review (on 3 October 2022) or when Optus’ Board resolved to retain Deloitte (on 11 October 2022), rather than when Optus’ lawyers formally engaged Deloitte (on 21 October 2022) or when the Deloitte Report was brought into existence (on 13 July 2023);
3. erred in rejecting or placing limited weight upon the unchallenged evidence of Optus’ General Counsel;
4. erred in drawing a Jones v Dunkel inference from the fact that, “no evidence was called” from Optus’ Chief Executive Officer in circumstances where “[Optus’ General Counsel] gave evidence as to conversations he had with [Optus’ CEO] on the engagement of Deloitte”; and
5. wrongly assessed Optus’ purpose principally by reference to statements made by its CEO in media releases, rather than evidence of conversations between Optus’ CEO and General Counsel leading to Optus’ decision to engage Deloitte.

The Full Courts’ reasons

The Full Court rejected each of Optus’ grounds of appeal finding that:

• Proof of the dominant purpose can be achieved in a variety of ways, and in discharging that onus, “focussed and specific” evidence is needed.
• The evidence at first instance established that the Deloitte Report was commissioned for multiple purposes including non-privileged purposes, which Optus did not dispute existed.
• Optus failed to adduce “focussed and specific evidence” to establish that the “legal purpose” for the Deloitte Report was the dominant purpose.
• Optus adduced little evidence as to the predominance of the legal purpose for procuring the Deloitte Report and Optus’ General Counsel’s evidence did not address or even acknowledge the existence of the non-privileged purposes of the Deloitte Report, nor did it explain or attempt to contextualise those non-legal purposes to try to establish that the legal purpose was the dominant purpose.
• The General Counsel's unchallenged evidence alone and state of mind were not of themselves determinative of the question of dominant purpose. The states of mind of the CEO and other Board members were also “highly relevant” to ascertaining the state of mind of Optus, given Optus' multiple purposes for procuring the Deloitte Report. 
• The primary judge correctly took into account the fact that no evidence was given directly by the CEO or the Board members about the purpose of the investigation (including hearsay evidence as to the state of mind of the CEO and the Board) and said that failure “fortified” the conclusion that Optus had not established that the legal purpose for the investigation was the dominant purpose.Such evidence was “critically relevant”, given the non-legal purposes for procuring the Deloitte Report.
• A Jones v Dunkel inference can be drawn in the context of a claim for privilege. The evidence before the primary judge was that there were numerous purposes for commissioning the Deloitte Report, including non-legal purposes. As the onus was on Optus to establish that the legal purpose for commissioning the Deloitte Report was the dominant purpose, evidence about the Optus CEO’s purpose was of “considerable importance”. Accordingly, Optus’ failure to call evidence from the CEO was “bound to be regarded as significant”. 
• The proper date to assess purpose is case-specific, but it will usually be the case that the relevant time to assess a party’s purpose for commissioning a report from a third-party will be at the time of commissioning. However, evidence as to events before or after the third-party has been formally retained and may also be relevant because the purpose for which a report is procured can be assessed across the continuum of time leading up to creation of a report. 
• The primary judge correctly identified that the purpose of the creation of the Deloitte Report was formed in the period when Optus’ CEO publicly announced the commissioning of the report (on 3 October 2022) and when the board resolved to procure the report shortly after (on 11 October 2022), rather than when the formal letter of engagement was issued (on 21 October 2022) or afterwards.

The Full Court concluded that the primary judge’s judgment was not attended with sufficient doubt to warrant a grant of leave to appeal, refused Optus’ application for leave to appeal, and ordered Optus to pay the applicant’s costs of and incidental to the application.

Impact of the decision

The Full Court’s decision serves as a timely reminder that where there are numerous purposes for the creation of a confidential document or communication, the legal purpose must predominate to attract legal professional privilege. 

In light of this decision, corporations and Boards, General Counsels, CEOs and other decision-makers should:

1. Be aware of all the reasons for commissioning a third-party provider to prepare a report and the purpose or purposes for that engagement, noting that Courts will look at all the circumstances of an engagement (in addition to the states of mind of relevant decision makers) to determine the dominant purpose for commissioning a third-party report;
2. accurately record and evidence the basis for any decision to commission a third-party provider to prepare a report and make clear in any record of decision that the purpose for commissioning the report is a legal one, where that is the case. This is particularly important where there are multiple purposes for commissioning a report; and
3. if engaged in legal proceedings which challenge a claim for privilege, adduce “focussed and specific” evidence in support of the purpose for which a document was created or communication made. This may include in some cases evidence from a company’s CEO and Board. Failure to do so may lead to a finding that a document or communication is not privileged.