Key points

• In McClure v Medibank Private Limited [2025] FCA 167, the Federal Court held that only some of the expert reports prepared for Medibank in relation to its 2022 data breach were subject to legal professional privilege. The basis for finding that three of these reports were not privileged was that the reports had been prepared for multiple purposes (only one of which was for a legal purpose).
• The decision, together with other recent Federal Court decisions such as Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58, serves as a reminder of the limits on the applicability of legal professional privilege in third party reports prepared for cybersecurity incidents.

Background

In McClure v Medibank Private Limited [2025] FCA 167, the applicants sought orders from the Federal Court requiring Medibank to produce a number of technical reports prepared by third parties for Medibank in relation to the 2022 data breach. 

Medibank asserted that the reports it had commissioned from third party consultants and cybersecurity experts were subject to legal professional privilege on the basis that the reports were commissioned for the dominant purpose of Medibank’s lawyers providing legal advice and assistance to Medibank in respect of the data breach.

Principles relating to legal professional privilege

Consistent with previous decisions relating to legal professional privilege in the context of cybersecurity experts’ reports into data breaches (including Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58), the Federal Court confirmed that, in order for legal professional privilege to apply, the communication must be made for the dominant purpose of giving or obtaining legal advice or the provision of legal services (including representation in legal proceedings). 

Further, the Federal Court held that simply making “references to privilege incantations, which of themselves, [are] divorced from the circumstances of the creation of the document are largely meaningless and not determinative of whether the particular report is the subject of legal professional privilege”. 

Instead, the application of legal professional privilege would be determined by “reference to the documents themselves and the purpose for which they came into existence”.

Applying these principles to each report in question

The principles relating to legal professional privilege are generally well-settled, and it is often the case that decisions will turn on the factual circumstances surrounding the making of each relevant communication. 

While the Federal Court considered each report separately, the Court generally held that:

• the technical reports prepared by digital forensic experts and cybersecurity experts were subject to legal professional privilege on the basis that the specific reports in question were commissioned in order for Medibank’s lawyers to understand the nature of the data breach (and subsequent ransom demand) and to allow them to advise Medibank on the investigation by the Office of the Australian Information Commissioner (OAIC) that had commenced at that time and on subsequent class action proceedings that were anticipated to be filed at that time (which subsequently were). Helpfully, the Court found that legal professional privilege could exist in circumstances where a report is prepared in response to a specific request for technical advice by Medibank’s external lawyers in order for them to provide legal advice to Medibank, despite that third party technical expert being engaged as part of a broader non-privileged engagement; and
• three reports of a more general nature that were prepared by third party consultants were not subject to legal professional privilege due to these reports having multiple different purposes, including operational and governance purposes, in addition to the legal purposes. As the legal purpose was not the dominant purpose, these reports were found not to be subject to legal professional privilege. A number of public statements by Medibank personnel and several ASX announcements referred to the engagement of third party consultants to prepare a report and to the purpose of that engagement being “to ensure that [Medibank] learn[s] from this event and continue to strengthen [its] ability to safeguard [its] customers”. Ultimately, these publicly stated purposes undermined Medibank’s ability to assert that these reports had been prepared for the dominant purpose of obtaining legal advice. 

The Federal Court also noted that a specific statement in an ASX announcement made on 28 April 2023 – relating to Medibank having received a third party report with recommendations to enhance Medibank’s IT processes and systems and that a number of recommendations have already been implemented by Medibank – resulted in a waiver of legal professional privilege in those specific parts of that third party report relating to the recommendations that were made.

Key takeaways

• Merely reciting that a document or communication is subject to legal professional privilege does not, of itself, make it privileged.
• The legal purpose must be the dominant purpose for which a document or report comes into existence or a communication is made in order for legal professional privilege to apply.
• In the context of a third party report commissioned as part of investigating and responding to a cybersecurity incident, organisations (and their legal advisors) should be clear as to the legal purpose for which the report is commissioned at the time of commission in order to provide a strong basis for claiming legal professional privilege in later proceedings. This decision highlights the importance of specifically commissioning reports that are to be used for legal purposes, especially where the relevant expert is providing broader services to the affected entity.
• Care must be taken by senior executives and board members when making public statements about the engagement of third party cybersecurity experts in relation to investigating and responding to a cybersecurity incident. While there is a strong (and understandable) temptation to make public statements referring to having received and acted on expert recommendations, this case is a reminder of the potential for such statements being argued to amount to a waiver of legal professional privilege in any subsequent legal proceedings.