Federal Court hands down a privilege lesson for cyber and critical incident responses

When Optus suffered a significant data breach on 22 September 2022, an immediate and sustained outcry arose from the public and from Australian politicians, demanding an explanation and action from Optus.

On 3 October 2022, Optus issued a media release announcing that it had engaged Deloitte to carry out "a forensic assessment of the cyber-attack and the circumstances surrounding it" and that "the review would ensure [Optus] understood how [the data breach] occurred and how [Optus] can prevent it from happening again".

Affected customers commenced a class action against Optus in the Federal Court in April 2023. When the claimants sought access to the Deloitte report, Optus resisted and argued that the report was subject to legal professional privilege as it had been commissioned for the 'dominant purpose' of obtaining legal advice.