Optus fails to prove Deloitte Report’s dominant purpose as ‘legal advice’

_{< Go back to Class Actions Landscape Australia}

This was an application for leave to appeal from the decision of the primary judge (Beach J) in Robertson v Singtel Optus Pty Ltd [2023] FCA 1392. The proceeding relates to the Optus data breach which occurred between 17 and 20 September 2022. In the decision appealed from, the primary judge held that the respondents (being the applicants for leave to appeal) (Optus) had failed to establish that an investigation report prepared by Deloitte (Deloitte Report) in relation to the data breach was covered by privilege.

In summary, the relevant background was:

• On 3 October 2022 Optus published a media release stating that it was appointing Deloitte “to conduct an independent external review of the recent cyberattack, and its security systems, controls and processes”.
• On 11 October 2022 the board of Optus formally resolved to retain Deloitte.
• On 21 October 2022 Optus’ external solicitors, Ashurst, formally retained Deloitte.
• The Deloitte Report was ultimately provided by Deloitte to Optus’ General Counsel and Company Secretary (Mr Kusalic), and to Ashurst (Optus’ external solicitors), on 13 July 2023.

At first instance the primary judge accepted that one of Optus’ purposes in procuring the Deloitte Report was to obtain legal advice in relation to the data breach (including as to the (rightly) anticipated class action(s) and civil penalty proceedings that were expected to come its way). However, his Honour concluded that Optus had multiple purposes in procuring the Deloitte Report, and that Optus had failed to discharge its onus to show that the legal purpose for procuring the report was the ‘dominant’ purpose.

The Full Court unanimously concluded that none of Optus’ proposed grounds of appeal had sufficient merit to warrant a grant of leave to appeal and therefore dismissed the application. In summary, the Full Court determined:

• The primary judge was correct to find on the evidence that there were multiple purposes for which the Deloitte Report was commissioned (only one of which was for legal advice / litigation purposes), and that the evidence did not establish that the Deloitte Report was procured for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory proceedings.

• Although the evidence of Optus’ General Counsel and Company Secretary (Mr Kusalic) as to the purpose for procuring the Deloitte Report was not challenged by way of cross-examination, the primary judge was not bound to accept his evidence uncritically and as being determinative, and instead was entitled to have regard to other contemporaneous, objective evidence, including the terms of the media release on 3 October 2022 and the terms of the board resolution on 11 October 2022 (neither of which referred to a legal purpose, and both of which demonstrated numerous non-legal purposes, for procuring the Deloitte Report). In circumstances where Mr Kusalic’s evidence did not even acknowledge or refer to those other (non-legal) purposes, it failed to establish that the legal purpose was the predominant or ruling purpose. In that respect, it was open to the primary judge to find that the evidence of Mr Kusalic was “vague, generalised, and ambiguous in key respects”.

• Further, whilst the evidence Mr Kusalic may have been sufficient to establish his purpose in procuring the Deloitte Report, it failed to adequately address the other purposes and states of mind of other relevant Optus personnel, including the CEO and members of the board, that were apparent from the media release and the board resolution referred to above.

• The proper date upon which to assess the dominant purpose will depend upon the particular circumstances of the case, but it will usually be the case that, where a party has commissioned a report from a third-party provider, the relevant time to assess the party’s purpose for doing so will be at the time of the report’s commissioning (in this case, 21 October 2022). However, that is not to say that evidence as to later events cannot be relevant (as the purpose of the report may evolve between the time of its commissioning and the time of its delivery). In any event, there was no evidence that Optus’ purpose relevantly changed between the date of the media release on 3 October 2022 and the date of delivery of the Deloitte Report on 13 July 2023, and in that respect no error was demonstrated in the approach which the primary judge took.

• In light of the above, the Court concluded (at [93], emphasis in original):

… Mr Kusalic’s evidence shows that his purpose for requesting an investigation and report by Deloitte was the legal purpose, and there is nothing to show any change in his purpose. He always had the same purpose. However, the evidence shows, and Optus accepted before us, that in fact it had multiple purposes for procuring the Deloitte Report. In those circumstances, the fact that Mr Kusalic took steps to carry into effect his purpose through Ashurst did not establish Optus’ dominant purpose. His evidence as to his purpose was just part of the evidence required to be taken into account in determining Optus’ dominant purpose. It was not good enough for Mr Kusalic’s evidence to establish that one of Optus’ purpose for procuring the report was the legal purpose. Optus needed to establish that the legal purpose was the dominant purpose, and as the primary judge explained it did not adduce adequate evidence to do so.

Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58

Federal Court of Australia, Murphy, Anderson and Neskovcin JJ, 27 May 2024
Applicants’ Solicitors: Ashurst
Respondents’ Solicitors: Slater and Gordon
Respondents’ Funder: N/A

AustLII link

_{< Go back to Class Actions Landscape Australia}