Federal Court of Australia

Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58

ORDERS

THE COURT ORDERS THAT:

1.    Leave to appeal be refused.

2.    The Applicants pay the Respondents’ costs of and incidental to the application.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

THE COURT

introduction

1    The applicants Singtel Optus Pty Ltd (SOPL) and its subsidiaries (Optus) apply for leave to appeal from orders 1 - 4 and 6 of the orders of a single judge of this Court made on 21 November 2023, the reasons for which were delivered on 10 November 2023: see Robertson v Singtel Optus Pty Ltd [2023] FCA 1392 (PJ).

2    The application for leave and, if leave be granted, the appeal concerns a privilege claim by Optus over a forensic investigation report prepared for one or more of the Optus parties by Deloitte Touche Tohmatsu (Deloitte), concerning a significant data breach involving the release of up to 9.5 million customers’ private and confidential information held by Optus, apparently as a result of a cyber-attack, between 17 and 20 September 2022. The cyber-attack was publicly announced by Optus on 22 September 2022. The report by Deloitte was commissioned at a time when Optus faced potential legal threats and challenges, including prospective class actions, regulatory investigations, customer claims and the need for advice concerning remedial steps required by legislation and regulations applying to Optus. The report was provided by Deloitte to Mr Nicholes Kusalic, Optus’ General Counsel and Company Secretary, and to Ashurst, the legal firm retained by Optus to provide legal advice in relation to the cyber-attack, on 13 July 2023 (Deloitte Report).

3    The primary judge accepted that Mr Kusalic formed the view that the cyber-attack would likely lead to one or more regulatory investigations, and subsequent litigation: (PJ [7]), and that the litigation and legal risks arising from the cyber-attack were at the forefront of the mind of Mr Kusalic when he first became aware of the cyber-attack: (PJ [10]). His Honour accepted that one of Optus’ purposes in procuring the investigation and report by Deloitte was the purpose of obtaining the report to assist Mr Kusalic, his legal team, Ashurst, and counsel retained by Ashurst to provide legal advice to Optus in relation to the litigation and regulatory risks Optus faced as a result of the cyber-attack (the legal purpose): (PJ [3], [121]). However, his Honour concluded that the Optus parties “had multiple purposes in procuring the review and report by Deloitte”: (PJ [3], [121]-[123]), and rejected Optus’ privilege claim on the basis that Optus had failed to discharge its onus to show that the legal purpose for procuring the Deloitte Report was dominant: (PJ [3] and [167]).

4    Optus contends that the primary judge erred in failing to find that the Deloitte Report had been created for the dominant purpose of enabling Optus to obtain legal advice or the provision of legal services to Optus for the purpose of actual or anticipated legal proceedings (Ground 1) because the primary judge:

(a)    wrongly assessed Optus’ purpose in procuring the Deloitte Report:

(i)    as at 3 October 2022 when Optus published a media release stating that it was appointing Deloitte “to conduct an independent external review of the recent cyberattack, and its security systems, controls and processes”; or

(ii)    as at 11 October 2022 when the board of SOPL (Board) resolved to retain Deloitte,

rather than 13 July 2023 when the Deloitte Report was brought into existence and provided to Mr Kusalic and Ashurst or 21 October 2022 when Ashurst formally engaged Deloitte (Ground 2);

(b)    erred in rejecting or placing limited weight upon the unchallenged evidence of Mr Kusalic, including by wrongly making adverse comments in relation to that unchallenged evidence, contrary to established authority (Ground 3);

(c)    erred in drawing an adverse inference from the fact that no evidence was called from Ms Bayer Rosmarin, Optus’ Chief Executive Officer (CEO), in circumstances where Mr Kusalic gave evidence as to conversations he had with Ms Bayer Rosmarin on the engagement of Deloitte (Ground 4); and

(d)    wrongly assessed Optus’ purpose principally by reference to statements made by its CEO in the 3 October 2022 media release, including by finding the statements in the media release to be the “best evidence” as to her purpose, rather than accepting Mr Kusalic’s evidence of conversations he had with the CEO leading to Optus’ decision to engage Deloitte, which Optus alleges supports the attested dominant purpose (Ground 5).

5    For the reasons we explain, the judgment of the primary judge is not attended by sufficient doubt to warrant leave to appeal being granted. We have made orders to dismiss the application for leave to appeal.

The evidence

6    Before the primary judge Optus relied on an affidavit by Mr Kusalic made 24 August 2023 (NK). The respondents relied on an affidavit of their solicitor, Mr Benedict Hardwick, made 8 September 2023, which annexed certain media releases and newspaper articles. Neither deponent was cross-examined.

7    Before the primary judge, Optus sought to discharge its onus to show a privileged purpose was dominant by relying upon the unchallenged affidavit evidence of Mr Kusalic and the inferences which it submitted arise from that evidence. For this reason, we now turn to consider Mr Kusalic’s evidence.

Mr Kusalic’s Evidence

8    Mr Kusalic gave evidence that he became aware of the cyber-attack on the morning of 21 September 2022, and formed the view that the incident would "almost certainly" result in regulatory investigations including by the Office of the Australian Information Commissioner (OAIC) and/or the Australian Communications and Media Authority (ACMA), and likely to result in subsequent legal action, including civil penalty proceedings, and also highly likely to lead to one or more class actions against Optus or a representative complaint with the OIAC. He expected there to be a strong customer reaction and ongoing complaints. He said that having regard to the magnitude of the cyber-attack and his expectations of the real likelihood of litigation and regulatory actions it was “immediately evident” to him that Optus would need to engage external lawyers with specific expertise in dealing with such matters: NK [14], [15], [17]-[18], [20]-[21].

9    Mr Kusalic contacted Ashurst on 22 September 2022, the day after he became aware of the cyber-attack, and Ashurst was retained to advise Optus in relation to the attack: NK [23]-[24]. The same day, Optus announced it had been the subject of a cyber-attack: NK [29]. Within a week, many of the legal threats Mr Kusalic had foreseen were forming (NK [29]-[42]), including that:

(a)    on 26 September 2022, Slater & Gordon announced they were investigating “a possible class action against Optus on behalf of current and former customers… affected by the unauthorised access to customer data” announced by Optus on 22 September 2022: NK [34];

(b)    on 28 September 2022, Maurice Blackburn made a similar announcement, and announced on 7 October 2022 that it had lodged a representative complaint with the OIAC: NK [35]-[36];

(c)    on 11 October 2022, the OIAC announced it had commenced an investigation into the “personal information handling practices” of Optus in regard to the cyber-attack: NK [41]; and

(d)    on 11 October 2022, the ACMA announced it had commenced an investigation in relation to the cyber-attack: NK [42].

10    Mr Kusalic:

(a)    formed the view, soon after the cyber-attack, that in order to assess Optus’ legal risk, it needed to undertake a confidential, forensic investigation into the root cause of the cyber-attack, so that Optus could obtain legal advice from him, his legal team, Ashurst and counsel briefed in the relevant matters: NK [44];

(b)    formed the view, within about a week after the cyber-attack, that the investigation was best handled by a party external to Optus which had specialist expertise in investigating and reporting on cyber matters: NK [45]-[46];

(c)    from the outset wanted to ensure that the independent specialist was engaged by Ashurst, and that the scope of the investigation was developed by his legal team in conjunction with Ashurst, so that the investigation and report would assist his team, Ashurst and counsel in advising Optus on the legal risks and regulatory implications arising from the cyber-attack: NK [47]-[49].

11    Mr Kusalic gave evidence that he had various discussions with Optus’ executives, including its CEO, the Vice President, Risk Management, the Chief Information Officer, the Director, Group, Internal Audit (Finance & Operations & Fraud Risk), the Head of SingTel IT Audit and Data, Analytics and Robotics Team “as to how we could best utilise Deloitte’s expertise to assist [Mr Kusalic] and Ashurst to give legal advice and manage the legal risk”. He said that “[w]e ultimately landed on Deloitte carrying out a forensic investigation into the root cause of the Cyber-attack and Optus’ response to it”. He also said that based upon these discussions, “we” recommended to the Board that Deloitte be engaged to carry out the investigation, “which would assist me, my team and Ashurst (and counsel briefed by Ashurst) in advising Optus in relation to the multiple legal risks and matters arising from the Cyber-attack”: NK [50] and [52].

12    Mr Kusalic said that on 3 October 2022 Optus announced in a media release that it was appointing Deloitte “to conduct an independent external review of the recent cyber-attack, and its security systems, controls and processes”, and he exhibited a copy of the release: NK [53].

13    The terms of media release are significant to the primary judges’ findings (PJ [29]) and it is convenient to set it out here.

14    Mr Kusalic gave evidence that although at the time of the media release Deloitte had been selected to undertake the external review Optus was yet to settle the terms of reference for the investigation. From 3 October 2022 to 9 October 2022 he proceeded to settle the terms of reference for Deloitte’s forensic investigation: NK [54]-[55].

15    Mr Kusalic gave evidence that although the decision to appoint Deloitte had already been made, for “good governance” the Board was asked to approve Deloitte carrying out the investigation: NK [56]. That approval came by way of a circular resolution, which Mr Kusalic drafted and emailed to the Board under a covering email which relevantly stated that “the Board is being asked to confirm the appointment of Deloitte”. The email to the Board is extracted at PJ [39]. Following feedback from one of the directors on the Board, Mr Kusalic revised the circular resolution he had drafted. On 11 October 2022 the Board approved the revised circular resolution.

16    The revised circular resolution as passed (extracted at PJ [42]) addressed the nature of the investigation to be undertaken, but it did not expressly state Optus’ purpose in appointing Deloitte: NK [57] and [59]. It stated:

SINGTEL OPTUS PTY LTD

ACN 052 833 208

CIRCULATING RESOLUTION OF THE DIRECTORS

UNDER RULE 2 OF CONSTITUTION AND SECTION 248A OF THE CORPORATIONS ACT 2001 (CTH)

We, being all the directors of Singtel Optus Pty Limited (‘Optus’) entitled to receive notice of a board meeting and to vote on the resolution, are in favour of the resolution set out below. The resolution is passed by the directors without a board meeting on the date and at the time when the last director signs.

APPOINTMENT OF DELOITTE TO INVESTIGATE CYBERATTACK

The directors of Optus NOTE the following:

(a)    on or around 22 September 2022 the directors were informed that Optus had been the subject of a cyberattack which involved unauthorised access to current and former Optus customers’ information (‘Cyberattack’);

(b)    the directors have requested the appointment of Deloitte to conduct independent external forensic reviews of the circumstances surrounding the Cyberattack having regard to the Optus Board’s delegation framework and with the support of the Singtel Board;

(c)    Deloitte has commenced aspects of its reviews; and

(d)    on Friday 7 October 2022 a media release by Maurice Blackburn Lawyers announced it had lodged a formal complaint with the Office of the Australian Information Commissioner (at the time of this resolution, no formal notification of this complaint has been received by Optus).

The directors of Optus RESOLVE:

(a)    that Deloitte be appointed to undertake independent external forensic reviews of the Cyberattack, including:

1.    to identify the circumstances and root causes leading to the Cyberattack;

2.    to review Optus’s management of cyber risk in the context of the applicable cyber risk management policies and processes in connection to the Cyberattack; and

3.    to review the Cyberattack incident response, and the appropriateness of actions taken, having regard to the existing crisis management policies and procedures; and

(b)    that, in relation to the reviews, Optus management be requested to report back to the Board, and in accordance with the Optus delegation framework.

17    The relevant change between the initial circular resolution drafted by Mr Kusalic, and the revised circular resolution subsequently passed by the Board, was an alteration to the words in subpara (b) at the end of the resolution: NK [57] and [59]. Before the revision subpara (b) read as follows:

(b)    to delegate finalising the scope and terms of the Deloitte reviews, provided they are not materially different to those above, to the Optus CEO and the Optus General Counsel and to request they report back to the Board once the reviews are sufficiently progressed.

18    On 17 October 2022, Mr Kusalic instructed Ashurst to engage Deloitte to undertake the external investigation in line with the Board resolution of 11 October 2022: NK [60].

19    On 21 October 2022, Ashurst formally engaged Deloitte with Deloitte sending Ashurst a formal letter of engagement (extracted in part at PJ [48]) (Deloitte Engagement Letter): NK [61].

20    Also on 21 October 2022, Mr Kusalic sent a letter to Deloitte in the following terms: NK [62].

Dear Messrs Blatchford and Pedley

We refer to your recent correspondence with Ashurst Australia, and the engagement letter (including the attached Standard Terms and Conditions) between Ashurst Australia and Deloitte Risk Advisory (Deloitte) dated 21 October 2022 (Engagement Letter). Capitalised terms in this letter have the same meaning as in those engagement letters, unless otherwise stated.

We confirm that we have instructed Ashurst Australia to engage Deloitte on behalf of Singtel Optus Pty Ltd (Optus), in connection with the recent Cybersecurity Incident, pursuant to Ashurst's engagement advising Optus.

Optus acknowledges and agrees that Deloitte will provide the services under the Engagement Letters on the condition that Optus will be bound by the terms of the Engagement Letters as if it were an Addressee of the Engagement Letter.

Optus further acknowledges and agrees that:

(a)    it will use its best endeavours to comply with the reasonable requests, suggestions and directions of Deloitte for the efficient conduct of the engagements;

(b)    where relevant it will obtain the necessary written authorisations from their Cloud Services / Third Party Hosting provider(s), for Deloitte to conduct testing against the Optus owned applications/infrastructure on Optus's behalf;

(c)    where relevant it will provide Deloitte details of any critical or fragile systems which should not be included in security testing activities and must inform Deloitte of any critical periods where testing should not be undertaken;

(d)    it is, and will continue to be, solely responsible for:

•    Establishing, maintaining and enforcing appropriate procedures and associated access controls and other technology measures over its systems and operations, including without limitation, systems designed to achieve its control objectives, financial reporting, monitoring of ongoing activities and systems designed to achieve compliance with applicable laws and regulations.

•    Providing in a timely manner all network, environment, programs, information, and data as required by Deloitte to perform the Services and its obligation under the Terms.

•    Informing Deloitte in a timely manner of any need to change the testing schedule.

•    Obtaining all necessary authorisations and consent from any third parties that may be directly affected by this engagement of Deloitte's activities.

•    Taking the necessary precautionary steps to ensure that vulnerability testing (if performed) will not, or will not be likely to, interfere with the functioning or availability of Optus systems prior to the testing commencing. Such steps should include but may not be limited to:

a.    Preparing backups of all data, configurations, programs, networks and systems which could be exposed to the vulnerability testing, to enable your staff to restore your systems to the state in which they were prior to the vulnerability testing.

b.    Updating and patching systems in accordance with current manufacturer and vendor recommendations.

c.    Having your key support staff available during the vulnerability testing.

•    Designating a competent employee with substantial computer systems, network and project management experience, preferably within senior management, to act as a point of contact for Deloitte.

In the event that vulnerability testing is undertaken Optus represents and warrants that:

(a)    any IP addresses provided to Deloitte for vulnerability testing are owned by, or licensed to, and used exclusively by Optus

(b)    any access or use of Optus network, environment, programs, information (including but not limited to personal information as defined under the Privacy Act 1988 (Cth)) and data as required to perform the Services will not:

•    constitute unauthorised access or otherwise breach the Terms; or

•    contravene the Criminal Code Act 1995 (Cth), the Crimes Act 1900 (NSW) and equivalent State or Territory legislation.

Optus further acknowledges that it may only use Deloitte's Work for the Purpose as set out in the Engagement Letters and that any use of or reliance on Deloitte's Work that is contrary to the terms of the Engagement Letter may expose Deloitte to a claim from someone with whom they have no relationship of whose interests Deloitte has not considered in providing the Services.

Optus agrees that it will indemnify Deloitte (the indemnified party), in each case in respect of the specific engagement entered into by the indemnified party, for:

(a)     any reasonable costs or expense that the indemnified party may incur in complying with any subpoena or request to produce its files or to provide evidence in respect of its Work. This indemnity does not apply to the extent that such costs are paid by the party making the request; and

(b)    any Loss that the indemnified party may suffer or incur in respect of any claim or action by a third party that arises as a result of:

(i) any use or distribution of, or reliance on, the indemnified party's Work that is contrary to the terms of the applicable engagement letter or a Consent; or

(ii) any access to or use of the indemnified party's Work, by any of Optus' Professional Advisers or Auditor.

This indemnity in (b) does not apply to any Loss incurred in defending a claim or action by a third party:

(iii) that results from any wilful misconduct or fraudulent act or omission by the indemnified party;

(iv) where that third party has signed an agreement with the indemnified party that provides that it can rely on the indemnified party's work; or

(v) where the indemnified party has agreed in writing that its Work may be included in publicly available documents.

Please do not hesitate to contact me should you have any queries or concerns regarding this letter.

Yours sincerely

Nick Kusalic

21    On 25 October 2022, Ashurst provided Deloitte with a general guidance note on privilege, a privilege protocol for the engagement and a non-disclosure agreement to be signed by each member of the “Deloitte team”: NK [63]. The first part of the protocol (extracted at PJ [58]) provided that the purpose of the Deloitte engagement was “to enable Ashurst to provide legal advice to Optus so as to fulfil its obligations and protect its rights in responding to the Cybersecurity Incident.”

22    Mr Kusalic gave evidence that a representative from Optus Legal and/or Ashurst attended each interview conducted by Deloitte and on 13 July 2023, Deloitte provided its report to Mr Kusalic and the partner at Ashurst: NK [64]-[65]. This is the relevant communication for which Optus claims privilege.

Relevant principles

23    The relevant legal principles applicable to Optus’ claim for legal professional privilege are not in dispute and were correctly set out by the primary judge at PJ [85]-[100]. We adopt the primary judge’s following summary of principles.

24    As the dispute relates to pre-trial disclosure, it is to be determined by reference to common law principles: PJ [85]. At common law, legal professional privilege applies to confidential communications made for the dominant purpose of the client obtaining legal advice or for use in litigation or regulatory investigations or proceedings. The protection is confined to confidential communications made for the dominant purpose of giving or obtaining (including preparation for obtaining) legal advice or the provision of legal services, including legal representation in litigation or other proceedings: PJ [87].

25    The purpose for which a document was created is a matter of fact to be determined objectively, having regard to the evidence, the nature of the document, and the parties’ submissions. Dominant purpose may be established by evidence and other material and circumstances showing such a description is justified. Proof of dominant purpose can be achieved in a variety of ways depending on the case at hand. In discharging that onus, focused and specific evidence is needed. But the nature and extent of the evidence needed to prove the existence of privilege is fact and circumstance dependent: PJ [89].

26    The evidence of the intention of the person who made the document, or the person who authorised or procured it, is not conclusive of purpose. In many instances, it is the character of the documents over which privilege is asserted that will illuminate the purpose for which they were created: PJ [90].

27    It is not sufficient to show a substantial purpose or that the privileged purpose is one of two or more purposes of equal weighting; rather it must be predominant and be the paramount or most influential purpose. The ordinary meaning of dominant purpose indicates the need for a ruling, prevailing or most influential purpose: PJ [91].

28    In addition to the primary judge’s summary of relevant principles we would add the following.

29    In Glencore International AG v Commissioner of Taxation [2019] HCA 26; 265 CLR 646 at [30], the High Court noted the importance of confining legal professional privilege “within strict limits”. One of those limits is to be seen in the requirement that a party claiming privilege satisfy the court of its purpose. The quality and precision of the evidence adduced in support of a claim for privilege is relevant, and dominance of purpose is not established by bare ipse dixit.

30    The Full Court of this Court in Kennedy v Wallace [2004] FCAFC 337; 142 FCR 185 at [4],[7],[14], [38] and [44] (Black CJ and Emmett J) noted that it is open to a trial judge having regard to the way in which a case is conducted to reject, or to accord limited weight, to assertions of a witness testifying that documents were for a privileged purpose. In that case, notwithstanding the subjective evidence of the person who created the document, the evidence of surrounding circumstances demonstrated the presence of such significant non-legal purposes that there was insufficient evidence to satisfy the Court that the legal purpose was dominant.

31    In Barnes v Commissioner of Taxation (Cth) [2007] FCAFC 88; 242 ALR 601 the Full Court cited Kennedy with approval and emphasised at [18] the need for “focused and specific evidence in order to ground a claim for legal professional privilege”, and then went on to say that “[t]he fact that generalised evidence is not challenged in cross-examination does not mean that such evidence must be accepted, particularly when it is as manifestly inadequate as it is in this case…Simply to show that one purpose for creation of the document was to obtain legal advice or assistance is not good enough.”

32    A court is not obliged to accept evidence of state of mind merely because it is asserted, and nor is it obliged to find evidence to be persuasive irrespective as to challenge by cross-examination, particularly where it is contradicted by facts otherwise established by contemporaneous material: Precision Plastics Pty Limited v Demir (1975) 132 CLR 362 at 370 – 371 (Gibbs J, with whom Stephen J agreed, and Murphy J generally agreed), or “the particular circumstances point to its rejection”: Ashby v Slipper [2014] FCAFC 15; 219 FCR 322 at [77] (Mansfield and Gilmour JJ).

Applicants submissions

Proposed Appeal Grounds 1, 3 and 4

33    Optus submits that despite Mr Kusalic’s evidence supporting the privilege claim, the respondents made the “calculated forensic” choice not to cross-examine him, no doubt wary that to do so may strengthen Optus’ position: Gwe v Commissioner of the Australian Federal Police [2020] NSWCA 247; 103 NSWLR 509 at [72]-[75] (Bathurst CJ, Bell P and Emmett JA agreeing).

34    Optus argues that this choice had consequences. It said that the respondents’ choice constrained the submissions which could properly be put and the findings which were open to the primary judge: Kuhl v Zurich Financial Services Australia Ltd [2011] HCA 11; 243 CLR 361 at [67]. It contends that according to Kuhl the primary judge could not make critical comments of Mr Kusalic as they had not been put to him. It notes that, as a general rule, unchallenged evidence ought to be accepted unless it is inherently incredible or contradicted by facts otherwise established on the evidence: Precision Plastics at 370 - 371. On its argument this rule applies a fortiori when the findings concern the integrity of a non-party solicitor such as Mr Kusalic: Ashby at [77] and [141]-[142]. It says that the general rule exists for good reason, as it is necessary to provide a witness with the opportunity of offering an explanation before “it is suggested that the story he tells ought not be believed”: Browne v Dunn (1893) 6 R 67; 1 WLUK 44 at [70]-[71].

35    On Optus’ submissions the primary judge fell afoul of these principles in going so far as to find that Mr Kusalic’s evidence “involved an element of reconstruction”: PJ [165], that his evidence on critical matters was “decidedly and no doubt self-advisedly vague”: PJ [83], and “less than transparent”: PJ [158], that if Optus’ purpose had really been as Mr Kusalic attested it was, Mr Kusalic would have drafted the Board circular resolution and covering email to the Board differently: PJ [165], and that subsequent documents, consistent with the purpose attested to by Mr Kusalic such as Deloitte’s actual retainer and Ashurst and Optus’ correspondence in response, were part of “endeavours to cloak the Deloitte review with legal professional privilege”: PJ [164]. It submits that these findings were central to the primary judge’s reasons for rejecting or discounting Mr Kusalic’s unchallenged evidence, and that those findings were not open given that Mr Kusalic had not been afforded an opportunity to respond to them: Kuhl at [67].

36    Optus argues that an inference that Optus’ CEO’s true or dominant purpose was contained in a 3 October 2022 media release (extracted above) was fundamental to the primary judge’s decision that the dominant purpose had not been established: PJ [29]. It contends that this involved the following errors:

(a)    First, it involved rejecting Mr Kusalic’s unchallenged evidence of the discussions he had with management, including the CEO, in which it was effectively agreed to appoint Deloitte “to assist [Mr Kusalic] and Ashurst to give legal advice and manage the legal risk”: NK [50];

(b)    Second, in drawing the inference as to the CEO’s purpose, the primary judge drew a Jones v Dunkel (1959) 101 CLR 298 inference against Optus for not calling direct evidence. Optus submits that such an adverse inference was not available as Optus was not required to call the CEO on an interlocutory application in circumstances where Optus’ General Counsel had given direct evidence of the conversations he had with the CEO about the reasons for engaging Deloitte, which was not challenged in cross-examination;

(c)    Third, the primary judge’s finding as to the CEO’s purpose rested upon the premise that the 3 October 2022 media release would naturally reveal all of the CEO’s purposes for agreeing to engage Deloitte, and his finding that it was “the best evidence that I have to illuminate her purpose”: PJ [127], such that it was significant that a legal purpose was not mentioned. Optus submits that the “best evidence” the primary judge had as to the CEO’s dominant purpose was in the non-public conversations the CEO had, as addressed in Mr Kusalic’s unchallenged evidence which supported the requisite dominant purpose.

37    Optus contends that the primary judge wrongly proceeded on the basis that Optus had three distinct purposes for engaging Deloitte, being (i) a legal advice or litigation purpose; (ii) identifying the root cause of the cyber-attack for management purposes and rectification; and (iii) the purpose of more generally reviewing Optus’ management of the cyber risk in relation to making changes to its policies and processes: PJ [120]-[123]. It says that those purposes were not discrete as its need for legal advice and services in relation to item (i) concerned the root cause of the cyber-attack and appropriate rectification in item (ii) and the review of management and changes in (iii).

38    It says that the authorities recognise that as privilege is a fundamental right, it should not be undermined by an overly narrow or technical approach, and that the concept of legal advice extends to what should prudently and sensibly be done in the relevant legal context: BWO19 v Minister for Immigration, Citizenship, Migrant Services and Multicultural Affairs [2020] FCAFC 181; 283 FCR 299 at [62]; AWB Ltd v Cole (No 5) [2006] FCA 1234; 155 FCR 30 at [44].

39    Optus also submits that the primary judge erred by giving weight to the fact that the Board’s circular resolution of 11 October 2022 did not record the legal purpose (PJ [43]), when that resolution is of little moment as it merely “confirmed” management’s decision to appoint Deloitte. And, in accordance with Mr Kusalic’s unchallenged evidence that decision was made for the purpose of enabling Optus to receive advice and legal services. The resolution simply approved the scope of Deloitte’s investigation and report without specifying Optus’ purpose for seeking the report.

Proposed Appeal Ground 2 – Assessing purpose before privilege communication

40    Optus submits that the primary judge’s errors were compounded by his assessing Optus’ dominant purpose at the wrong time. The primary judge assessed the dominant purpose for which the Deloitte Report was brought into existence as at the time of the 3 October 2022 media release or 11 October 2022 when the Board’s circular resolution confirmed Deloitte’s engagement: PJ [135] and [161].

41    It contends that the general rule is that ‘purpose’ is to be assessed at the time that a communication is made, which in the case of a written communication is when the document came into existence, being in this case, 13 July 2023. It argues that the significance of the primary judge adopting the wrong dates is that it caused an improper focus upon evidence the primary judge found did not support the asserted dominant purpose, being the 3 October 2022 media release and the circular Board resolution. Thus, the primary judge found the form of the later main retainer letter could not change the earlier formed dominant purpose at 3 or 11 October 2022: PJ [161].

Proposed Appeal Ground 5 – Wrong decision maker

42    On Optus’ submissions, the primary judge also erred by concluding that the appropriate decision makers for the purpose of the dominant purpose test included the Optus CEO and/or the Board: PJ [129].

43    It contends that where a corporation claims legal professional privilege, it is the corporation’s mind and purpose that is relevant. It says that the corporation’s employees’ state of mind may be attributed to it and where the communication in question is a document, the person whose purpose is relevant will generally be the person who either created the document or caused the document to be created. In this case, Optus submits that the Board’s role was not such that it could be said to be the person who caused the creation of the Deloitte Report, as the Board confirmed an earlier decision made by management.

44    Optus says that, technically, it was Ashurst which retained Deloitte and the evidence demonstrates that Ashurst’s purpose in doing so was to enable it to advise Optus pursuant to its retainer. Optus submits that it is also clear that amongst Optus’ management, from beginning to end, Mr Kusalic was the driving force for engaging Deloitte. Optus submits that if anyone within Optus management could speak to the corporation’s mind concerning the Deloitte Report, it was Mr Kusalic. It notes that Mr Kusalic did so, and his evidence was not challenged.

Leave to Appeal

45    Optus submits that the judgment at first instance is attended with sufficient doubt to warrant the grant of leave and the appeal on each of the grounds advanced should be allowed. In addition, it contends that a determination by the Full Court on Ground 3 would provide appellate authority on an issue on which the decision in Terracom Ltd v Australian Securities and Investments Commission [2022] FCA 208; 401 ALR 143 conflicts with the primary judge’s reasons. Finally, it argues that although the case involves questions of practice and procedure, its outcome determines important substantive rights and as such, the restraints to which an appeal court might otherwise submit itself should not be rigidly applied: Choy v Tiaro Coal Ltd (in liq) [2018] NSWCA 205; 98 NSWLR 493; 364 ALR 554; 130 ACSR 475 at [8].

Consideration

46    For the reasons that follow, the primary judge’s judgment is not attended with sufficient doubt to warrant a grant of leave to appeal. Moreover, in our opinion, the primary judge was correct to find on the evidence that there were multiple purposes for which the Deloitte Report was commissioned and that the evidence did not establish that the Deloitte Report was procured for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory proceedings.

Proposed Appeal Grounds 1, 3, 4 & 5 – Dominant purpose

47    Central to Optus’ argument is that the primary judge should have found that the affidavit evidence of Optus’ General Counsel, Mr Kusalic, was conclusive on the question of dominant purpose. The primary judge carefully considered the evidence of Mr Kusalic as being one of the relevant minds but nevertheless found, on the totality of the evidence, that his state of mind and conduct was only part of the analysis. The primary judge found, correctly, that the states of mind of the CEO and the other board members were, on the evidence, also highly relevant to ascertaining the state of mind of Optus given Optus’ multiple purposes for procuring the Deloitte Report. The primary judge also, correctly, examined primary documents and drew appropriate inferences from a consideration of the evidence as a whole.

48    The primary judge found that Optus had multiple purposes including:

(i)    a legal advice or litigation or regulatory proceeding purpose;

(ii)    a purpose more generally to identify the circumstances and root causes of the cyber-attack for management purposes;

(iii)    a purpose of reviewing Optus management’s policies and processes in relation to cyber risk: PJ [120]-[123].

49    Before the primary judge, Optus did not dispute that the non-privileged purposes in items (ii) and (iii) above existed, but it did not adduce “focused and specific evidence” (Barnes at [18]) to establish that the legal purpose under item (i) was the dominant purpose. The primary judge found, correctly in our view, that Optus failed to discharge its onus to show that the legal purpose was dominant: PJ [3] and [167].

50    In large part that is because:

(a)    Optus adduced little evidence as to the predominance of the legal purpose for procuring the Deloitte Report against a background where there existed non-legal purposes; and

(b)    Mr Kusalic’s evidence did not address or even acknowledge the existence of the non-legal purposes shown by the evidence, nor explain or attempt to contextualise the non-legal purposes as opposed to the legal purpose and thereby establish that the legal purpose was Optus’ dominant purpose.

51    In particular, Mr Kusalic did not explain or contextualise the non-legal purposes averted to by Optus’ media release of 3 October 2022 (extracted above at [13]), which said that Ms Bayer Rosmarin, Optus’ CEO, had recommended the Deloitte review which had been “supported unanimously by the Singtel board”. The release described the proposed Deloitte investigation as an “independent external review of the recent cyber-attack, and [Optus’] security systems, controls and purposes”. The media release attributed the following to the CEO:

This review will help ensure we understand how [the cyber-attack] occurred and how we can prevent it from occurring again. It will help inform the response to the incident for Optus. This may also help others in the public and private sector where sensitive data is held and risk of cyberattack exists.

I am committed to rebuilding trust with our customers and this important process will assist those efforts.

: PJ [29]-[32], [124]-[126].

52    Those non-legal purposes for undertaking the Deloitte review were also referred to in the revised circular resolution passed by the Board on 11 October 2022 (extracted above at [16]): PJ [38]-[43], [147]-[157], which said:

The directors of Optus RESOLVE:

(a)    that Deloitte be appointed to undertake independent external forensic reviews of the Cyberattack, including:

1.    to identify the circumstances and root causes leading to the Cyberattack;

2.    to review Optus’s management of cyber risk in the context of the applicable cyber risk management policies and processes in connection to the Cyberattack; and

3.    to review the Cyberattack incident response, and the appropriateness of actions taken, having regard to the existing crisis management policies and procedures.

53    The primary judge was correct to find that the totality of the evidence did not indicate that Mr Kusalic’s state of mind was determinative: PJ [129]-[133]. Based on Optus’ own media release, it was the CEO who recommended the Deloitte review to the Board, which supported her recommendation. Mr Kusalic was a recommender to the recommender in relation to the proposed investigation, with a particular legal focus, and the evidence showed the existence of other purposes. Essentially, his Honour held that simply to show that one purpose for the creation of the Deloitte Report was so that Optus could obtain legal advice or assistance was not good enough.

54    To determine whether the evidence established that the legal purpose under item (i) set out above in paragraph 48 was the dominant purpose, the primary judge was required to consider the objective probabilities on the totality of the evidence, having proper regard to both what Optus’ affidavit evidence said and what it did not say or explain. The primary judge undertook this task with particular care as is evident from his analysis: PJ [119]-[167].

55    We do not accept Optus’ submission that the primary judge was bound to give overwhelming significance to Mr Kusalic’s frame of mind for the purpose of establishing that the legal purpose was the dominant purpose, nor bound to accept the unchallenged evidence of Mr Kusalic. Mr Kusalic’s evidence was, as the primary judge said, only part of the necessary analysis: PJ [129]-[133]. In particular, the primary judge:

(a)    acknowledged that Mr Kusalic had a personal concern that the cyber-attack was likely to result in regulatory investigations and litigation and took various steps to address those risks (PJ [7]-[23], [45]-[47], [70]-[72], [76], [102]-[104]), taking note of the evidence in relation to Mr Kusalic’s roles and responsibilities, but also noting that his evidence often did not identify what role he was acting in, Company Secretary or General Counsel, when taking certain actions: PJ [66]-[69], [82];

(b)    took into account that Mr Kusalic subjectively wanted Deloitte to undertake the investigation for legal purposes, and always intended for Deloitte to be appointed by lawyers: PJ [74]-[75]; and

(c)    considered Mr Kusalic’s evidence of discussions with the CEO and other senior managers about the need for an independent review into the cyber-attack and how Deloitte was identified as a consultant to carry out a forensic investigation, but found that this evidence was “pregnant with imprecision” and had a “superficial” quality including because it was unclear who had proposed Deloitte and when. These were findings which were open to the primary judge to make: PJ [24]-[28], [105], [111]-[112], [131]-[132].

56    Optus seeks to make too much out of Mr Kusalic’s evidence regarding his discussions with the CEO and other senior managers. Everything that he said about any discussions he had with the CEO and other senior managers was in two paragraphs of his affidavit, where he said the following (NK [50], [52]):

As I stated above, Optus was considering a range of investigations and in the context of that consideration Deloitte had been proposed to assist Optus in carrying out an investigation into the Cyber-attack and Optus’ response. I had various discussions with members of the senior management team at Optus [there setting out the names and titles of the CEO and relevant senior managers] as to how we could best utilise Deloitte’s expertise to assist me and Ashurst to give legal advice and manage the legal risk. We ultimately landed on Deloitte carrying out a forensic investigation into the root cause of the Cyber-attack and Optus’ response to it.

…

Based on these discussions, we recommended to the SOPL Board that Deloitte be engaged to carry out a forensic investigation into the Cyber-attack and Optus’ response to it, which would assist me, my team and Ashurst (and counsel briefed by Ashurst) in advising Optus in relation to the multiple legal risks and matters arising from the Cyber-attack as I have explained above.

57    That evidence confirmed Mr Kusalic’s purpose, and his evidence overall indicates that from the outset he was concerned to obtain a report from Deloitte to assist him, his legal team, Ashurst and counsel briefed by Ashurst to provide advice in relation to the litigation and regulatory investigation risks he perceived. Nothing in the evidence indicates that his purpose changed. But Mr Kusalic’s evidence as to those discussions is both general and vague. For example, he did not say when or where those discussions took place, he did not say whether they were joint discussions, or whether he met individually with the CEO and the senior managers. In particular, he did not say anything about the other reasons for the investigation which the CEO publicly said existed in the media release, or which the Board had recorded in the circular resolution confirming Deloitte’s appointments, nor did he say anything as to whether he was aware from any of the other senior Optus managers he spoke to that they wanted information from Deloitte’s investigation for other reasons.

58    Nor did he expressly state that the primary or dominant purpose of the CEO or the senior managers he spoke to for procuring the Deloitte Report was the legal purpose. The highest his evidence went was to say that based on those discussions “we” recommended that Deloitte be engaged “which would assist me, my team and Ashurst (and counsel briefed by Ashurst) in advising Optus in relation to the multiple legal risks and matters arising from the Cyber-attack” (emphasis added). We can accept that the CEO and other senior managers might expect that the proposed report by Deloitte would assist Mr Kusalic, his team, Ashurst and counsel to provide legal advice, but in circumstances where the evidence showed multiple purposes that evidence was inadequate to show that that the legal purpose was Optus’ dominant purpose. It would have been straightforward for Mr Kusalic to explain that in the discussions to which he referred it had been decided that the non-legal purposes expressed by the CEO and by the Board had either become subsidiary or had fallen away, but he did not. We cannot accept the submission of Mr Finch SC, Senior Counsel for Optus, that while Mr Kusalic’s affidavit did not engage in “the New South Wales fetish of direct speech”, his evidence “perfectly clearly” summarises the discussions Mr Kusalic had. That is simply not the case.

59    As the primary judge found, the words attributed to the CEO in the 3 October 2022 media release “manifested a dominant purpose which was other than a legal advice or litigation purpose” (PJ [79]), yet Mr Kusalic did not explain or contextualise those non-legal purposes as opposed to his legal purpose, let alone give “focused and specific evidence” in that regard so to prove that the legal purpose was Optus’ dominant purpose.

60    The primary judge’s analysis took into account other contemporaneous documentary evidence and inferences that arose from the evidence as a whole. These included that the primary judge:

(a)    gave detailed consideration to Optus’ public statements in relation to Deloitte’s investigation between 3 October 2022 and 9 March 2023, including specific words attributed to the CEO in the 3 October 2022 media release: PJ [29]-[33], [56]-[57], [63]-[64], [116]-[117]. His Honour concluded, correctly in our view, that Ms Bayer Rosmarin’s statements that:

(i)    “the forensic review would play a crucial role in the response to the incident for Optus, as it works to support customers”;

(ii)    “…we are determined to find out what went wrong. This review will help ensure we understand how it occurred, and how we can prevent it from occurring again. It will help inform the response to the incident for Optus…”; and

(iii)    “I am committed to rebuilding trust with our customers and this important process will assist those efforts”;

did not suggest a dominant legal purpose, but did suggest that the dominant purpose in the mind of Ms Bayer Rosmarin and the Board was not a defensive legal or litigation strategy but to “identify the cause of what occurred so that rectification steps could be carried out to prevent a recurrence”: PJ [124]-[126], [137]-[138];

(b)    carefully considered the terms of the draft and final resolutions confirming the engagement of Deloitte and the history of the amendments to the resolution drafted by Mr Kusalic which resulted in the deletion of the draft term which would have delegated power over the report to Mr Kusalic, and instead required all Optus management to report to the Board in relation to Deloitte’s “reviews”, for which there was “no explanation”: PJ [38]-[43], [147]-[150], [158] and [165];

(c)    gave detailed consideration to the communications between Mr Kusalic and the Board around that time, including where Mr Kusalic described Deloitte’s appointment by reference to the announcement and without reference to a legal purpose: PJ [38]-[43], [147]-[150] and [165]; and

(d)    considered the fact that Deloitte had already commenced work before the Deloitte engagement letter of 21 October 2022 was issued in circumstances where it was not clear that that work was being done under the auspices of Ashurst: PJ [157]-[164].

61    The primary judge took into account, correctly in our view, that no evidence was given directly by the CEO, or the Board members, concerning the purpose of the investigation and said that Optus’ failure to adduce evidence from its CEO fortified the conclusion that Optus had not established that the legal purpose for the investigation was the dominant purpose: PJ [139]. In Hancock v Rinehart (Privilege) [2016] NSWSC 12 at [7], Brereton J emphasised the need for a party claiming privilege to do so by admissible direct evidence, not hearsay. His Honour said:

To sustain a claim of privilege, the claimant must not merely assert it; but must prove the facts that establish that it is properly made. Thus a mere sworn assertion that the documents are privileged does not suffice, because it is an inadmissible assertion of law; the claimant must set out the facts from which the court can see that the assertion is rightly made, or in other words “expose … facts from which the [court] would have been able to make an informed decision as to whether the claim was supportable”. The evidence must reveal the relevant characteristics of each document in respect of which privilege is claimed, and must do so by admissible direct evidence, not hearsay.

(Emphasis added. Footnotes omitted.)

62    That passage has been cited with approval in Martin v Norton Rose Fulbright Australia [2019] FCA 1101 at [54], [63] (White J); Quach v MLC Life Ltd (No 2) [2019] FCA 1322 at [8] (Griffiths J); Friday v Minister for Primary Industry and Resources [2020] FCA 984 at [24] (SC Derrington J); Attorney-General (NSW) v Melco Resorts & Entertainment Ltd [2020] NSWCA 40; 102 NSWLR 47; 380 ALR 1 at [76] (Bathurst CJ, Bell P and Gleeson JA); and Australian Securities and Investments Commission v RI Advice Group Pty Ltd [2020] FCA 1277; 148 ACSR 1 at [42] (O’Callaghan J).

63    Here, not only did Optus not put on direct evidence from Ms Bayer Rosmarin or any Board member, Mr Kusalic’s evidence did not even provide hearsay evidence, on the basis of information and belief, as to Ms Bayer Rosmarin’s state of mind, or as to the state of mind of the Board members to the extent that he talked to them. Such evidence would have been admissible: s 75 of the Evidence Act 1995 (Cth). Evidence as to their state of mind was critically relevant once it is appreciated that the media release and the circular resolution showed the existence of non-legal purposes for procuring the Deloitte Report.

64    Optus’ submission that no Jones v Dunkel inference could be drawn must be rejected. First, a Jones v Dunkel inference can be drawn in the context of a parties’ claim for privilege: RI Advice Group at [48]-[49]; Perry v Powercor Australia Ltd [2011] VSC 308 at [72] (Robson J); Powercor Australia Ltd v Perry [2011] VSCA 239; 33 VR 548 at [26]-[28] (Warren CJ, Nettle and Tate JJA). There was evidence before his Honour as to a multiplicity of purposes for commissioning the Deloitte Report. The media release showed that Ms Bayer Rosmarin had recommended its commissioning and had expressed non-legal purposes for doing so, and the Board had unanimously agreed with that recommendation. Optus had the burden of establishing that the legal purpose was the dominant purpose for which the Deloitte Report was commissioned and therefore Ms Bayer Rosmarin’s purpose was of considerable importance. The applicants’ failure to call her to give evidence was bound to be regarded as significant.

65    Second, Optus’ contention that it was not open to draw a Jones v Dunkel inference when Mr Kusalic had provided “direct evidence of conversations he had with the CEO about the reasons for engaging Deloitte” must be rejected. As we have said, the only evidence Mr Kusalic gave as to his discussions with Ms Bayer Rosmarin was in [50] and [52] of his affidavit (extracted above at [56]) in which he said he had discussions with her and other senior managers “as to how we could best utilise Deloitte’s expertise to assist me and Ashurst to give legal advice and manage the legal risk”. That primarily spoke to his purpose for obtaining the Deloitte Report, and he did not say anything about Ms Bayer Rosmarin’s non-legal purposes, or what she said at the time, so as to establish that the legal purpose was Optus’ dominant purpose. The primary judge did not err in using Jones v Dunkel to more readily infer that her evidence would not have assisted Optus’ claim for privilege. Nor, contrary to Optus’ submissions, did the primary judge err in finding that the best evidence of Ms Bayer Rosmarin’s purpose was what she said in the 3 October 2022 media release.

66    The primary judge was not obliged to treat Mr Kusalic’s evidence as determinative regarding the purpose of the Deloitte Report merely because he was not cross-examined on that evidence. Optus’ repeated submission that his evidence was ‘unchallenged’ and must be accepted is misconceived. It may, depending on the particular circumstances of a case, be “wrong, unreasonable or perverse” to reject unchallenged evidence, and such an error may be a basis for overturning a decision, but there is no rule of law that a court must accept unchallenged evidence: Ashby at [78] citing Ellis v Wallsend District Hospital (1989) 17 NSWLR 553 at 587-588 (Samuels JA). The fact that generalised evidence is not challenged in cross-examination does not mean that such evidence must be accepted, particularly when it is inadequate and the totality of the evidence points to its rejection, as it did in this case.

67    The primary judge found that Mr Kusalic’s evidence neither had the requisite quality of precision in relation to what it did address, nor did it address contemporaneous documents which pointed in the opposite direction, such as the 3 October 2022 media release, and that Mr Kusalic’s evidence did not establish that the legal purpose of which Mr Kusalic gave evidence was Optus’ dominant purpose. Those were findings which were open to the primary judge. That was so because Mr Kusalic’s evidence had the deficiencies set out at paragraphs 57 to 58 above.

68    A proper consideration of the primary judge’s analysis reveals that it was open to the primary judge to find that Mr Kusalic’s evidence was vague, generalised, and ambiguous in key respects.

69    Faced with an absence of evidence from Optus on critical matters upon which it bore the onus, the primary judge did not err in:

(a)    finding that the relevant state of mind to attribute to Optus was referable to Optus’ CEO, and the other Board members, as well as Mr Kusalic: PJ [128]-[133]; or

(b)    relying upon evidence not adduced by Optus in seeking to determine the subjective purpose held by Optus’ CEO, and the Board: PJ [120]-[127], [137]-[138] as viewed within the context of all the circumstances which the primary judge set out in detail: PJ [140]-[164].

70    Much of Optus’ submissions were devoted to the contention that the primary judge had improperly criticised Mr Kusalic’s evidence in circumstances where none of those matters had been put to him, and that his Honour had erred by making findings of misleading behaviour by Mr Kusalic, in an attempt to bolster its argument that the primary judge erred in not accepting his unchallenged evidence. In this regard Optus principally relied on the primary judge’s remarks that:

(a)    critical aspects of Mr Kusalic’s evidence were “decidedly and no doubt self- advisedly vague”: PJ [83];

(b)    Mr Kusalic made “vague statements on matters of significance” which justified giving them reduced weight: PJ [127];

(c)    “I am fortified in my analysis by the vagueness in how Mr Kusalic expressed himself in his evidence”: PJ [131];

(d)    Mr Kusalic’s explanation for the amendment to the circular resolution was “less than transparent”: PJ [158];

(e)    “Clearly, endeavours to cloak the Deloitte review with legal professional privilege were more to the fore in late October 2022 than they were at the start of the month.”: PJ [164]; and

(f)    “I cannot help thinking that if the dominant purpose of Optus was as Mr Kusalic now says it is, he would not have drafted his 9 October 2022 email or the draft or final resolutions on 9 and 11 October 2022 respectively as they were expressed…To some degree this is speculation, but I have an uncomfortable sense that important aspects of Mr Kusalic’s affidavit concerning the time-frame prior to mid-October 2022 has involved an element of reconstruction”: PJ [165].

71    Senior Counsel for Optus submits that one of the “most disturbing aspects” of the primary judgment is that his Honour found that the events in late October 2022 constituted an attempt by Mr Kusalic to cloak what was not, by then, Optus’ dominant purpose of obtaining legal advice with the appearance of a dominant purpose of legal advice. He contends that, as Optus only relied on Mr Kusalic’s evidence, the reference to “endeavours to cloak” must be a reference to Mr Kusalic’s conduct, and it carried the finding that he endeavoured to disguise or mislead the Court as to the true position in relation to Optus’ purpose. Senior Counsel went as far as to submit that:

…the importance of his Honour's finding is that there must be, in those circumstances then, an initial state of mind, in [Mr Kusalic’s mind], then a change in corporate mind - in the minds of the CEO and the board, being apparently representative of that - and a decision to cloak that by Mr Kusalic and, presumably, the board and the CEO, by engaging in modifying the letters of engagement, so that they falsely represent a dominant purpose, which, by then, was not true.

72    Those criticisms of the primary judge’s reasons are overstated.

73    First, it should be understood that the respondents did not contend below that Mr Kusalic’s evidence should be disbelieved, or that his evidence showed that he had engaged in misleading behaviour by asserting that Optus’ purpose for obtaining the Deloitte Report was the legal purpose. Their case was that Mr Kusalic’s evidence was insufficient to establish that Optus’ dominant purpose for obtaining the Deloitte Report was the legal purpose. There was no requirement for the primary judge to express any concluded view as to Mr Kusalic’s credit.

74    Second, the notion that the primary judge found that Mr Kusalic, the CEO and the Board had an initial view, which they then altered, and were each then engaged in an attempt to deceive in relation to Optus’ purpose for commissioning the Deloitte Report is a construction without foundation. The primary judge did not find that. The primary judge was satisfied that Mr Kusalic’s purpose was the legal purpose throughout but, having regard to the evidence that the CEO and the Board had other purposes, his evidence was insufficient for the conclusion that the legal purpose was Optus’ dominant purpose. The notion that the CEO and the Board shared Mr Kusalic’s purpose is grounded in [50] and [52] of his affidavit, which evidence is vague and inconclusive, and does not establish that.

75    Third, contrary to Optus’ submissions, the primary judge’s remarks at PJ [83], [127], [131] and [158] do not constitute adverse findings as to Mr Kusalic’s credit, integrity or probity. The central thrust of those remarks is that the primary judge found Mr Kusalic’s evidence to be vague in relation to some matters of significance, and that his evidence in relation to the change between the initial and the revised circular resolution was not explained. His Honour was not there saying that Mr Kusalic had not been candid or had sought to mislead.

76    To determine whether the evidence established that the legal purpose was Optus’ dominant purpose the primary judge was required to consider the objective probabilities on the totality of the evidence, having proper regard to both what Mr Kusalic’s evidence said and what he did not say or adequately explain. Having regard to Mr Kusalic’s affidavit, it was open to the primary judge to find that his evidence was vague on important matters and unclear on the matter to which it referred. Indeed, in our view his Honour was correct in so finding.

77    The situation is a little different in relation to the primary judge’s use of the expression “self-advisedly vague”: PJ [83]. Senior Counsel for Optus submits that expression steps across the line in Kuhl, and says that the primary judge there found that “Mr Kusalic was clearly and deliberately vague about critical aspects of his evidence, which can only mean the dominant purpose, because nothing else was critical. So it’s quite clearly, then, an express finding about his credit, and his integrity and his probity.”

78    That contention is overblown. Mr Kusalic is a solicitor giving evidence in relation to a claim for privilege, and in that sense he can be said to be self-advised. And his evidence in relation to the non-legal purposes expressed by Ms Bayer Rosmarin and the SOPL Board was vague and inadequate to establish that the legal purpose was Optus’ dominant purpose. To the extent that the expression “self-advisedly vague” might be read to carry the implication that Mr Kusalic’s evidence was deliberately vague, we accept that it should not have been said. But it is an exaggeration to describe it as an attack on Mr Kusalic’s credit, integrity and probity when the primary judge clearly accepted Mr Kusalic’s evidence as to his purpose for procuring the Deloitte Report. The inadequacy in his evidence as found by the primary judge was not in relation to his credibility but that, in circumstances where the evidence showed that Optus had multiple purposes, his evidence did not address, or even acknowledge, the existence of the non-legal purposes nor explain or attempt to contextualise the non-legal purposes as opposed to the legal purpose, and thereby prove that the legal purpose was Optus’ dominant purpose.

79    Fourth, Optus’ submissions that the primary judge erred in finding that Mr Kusalic had “endeavoured to cloak”, or in other words disguise the true position in relation to Optus’ purpose, and that his evidence was a “reconstruction” are centrally based in the primary judge’s remarks at PJ [164] and [165]. On a fair reading of the primary judge’s reasons, those remarks are not findings at all, and they do not have the significance that Optus seeks to give them.

80    It is unnecessary for us to summarise the primary judge’s reasons, and it suffices to note that his Honour’s approach to the questions raised by the application was painstakingly thorough and careful. By the time his Honour got to PJ [164] and [165] he had repeatedly explained the basis for his view that, in circumstances where the evidence showed that Ms Bayer Rosmarin and the Board had several non-legal purposes for seeking the Deloitte Report, Mr Kusalic’s evidence regarding the legal purpose for the report was inadequate to establish that the legal purpose was Optus’ dominant purpose. None of that, or his Honour’s repeated statements about the inadequacy of Mr Kusalic’s evidence, was based on any finding that Mr Kusalic had sought to mislead the Court as to the true position regarding Optus’ dominant purpose.

81    At PJ [161] his Honour reiterated his conclusion that he was not satisfied that the legal purpose was Optus’ dominant purpose. Then, in something of an addendum, the primary judge said that “[t]wo other points should also be made”: PJ [163]. His Honour then made the impugned remarks in the following two paragraphs, PJ [164] and [165]. Importantly, his Honour concluded (at PJ [166]) by stating:

Now, there has been no cross examination so I cannot make hard findings.

On a fair reading of the primary judge’s reasons, at PJ [164] and [165] his Honour noted two matters that concerned him about Mr Kusalic’s evidence, but then said, correctly, that in the absence of cross examination he could not make findings in that regard.

82    Optus argues, in reliance on Kuhl at [75], that there was no point in the trial judge mentioning his view as to those parts of Mr Kusalic’s evidence unless it played a role in his decision adverse to Optus. We take a different view. First, considered textually we see those remarks as an addendum and far from central to the decision. Second, in Kuhl the trial judge did not expressly say that he was not making a finding. Here, his Honour did.

83    Fifth, the primary judge's remarks in PJ [164] and [165] are not material to his Honour’s conclusion that Optus had not discharged the onus of establishing its claim of privilege. If those criticisms are put to one side, it would remain our view that the primary judge’s judgment is not attended with sufficient doubt to warrant the grant of leave. It would remain the case that we consider the primary judge was correct to find that there were multiple purposes for which the Deloitte Report was commissioned and that the evidence did not establish that it was procured for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory proceedings.

Proposed Appeal Ground 2 – The time for assessment of dominant purpose

84    The primary judge held that the relevant time frame for assessing the dominant purpose for which the Deloitte Report was brought into existence was either on 3 October 2022 when Optus referred to Deloitte being retained on Ms Bayer Rosmarin’s recommendation or on or prior to 11 October 2022 when the Board by resolution procured the Deloitte review. His Honour, however, accepted that later events including up to the time when the report was brought into existence and communicated can and should be looked at in assessing purpose, citing Singapore Airlines Ltd v Sydney Airports Corporation [2004] NSWSC 380 at [17] to [22] (McDougall J): PJ [135]. That part of McDougall J’s reasons was not disturbed on appeal in Sydney Airports Corporation Ltd v Singapore Airlines Ltd [2005] NSWCA 47.

85    Optus, by its proposed Ground 2 and in written submissions, argues that the correct time to assess its purpose for procuring the Deloitte Report is either 21 October 2022 when Deloitte issued Ashurst with its formal engagement letter or 13 July 2023 when Deloitte provided its report to Optus and Ashurst. Optus’ principal submission is that the primary judge should have assessed its purpose as at 21 October 2022, and it said little in relation to its contention that 13 July 2023 is the relevant date.

86    There is no substance in this proposed ground of appeal.

87    In Singapore Airlines McDougall J held that the relevant time for assessing the purpose of a report commissioned by an external solicitor is at the time that the report is commissioned, and also said that did not mean that it was illegitimate to look at anything that occurs after the report is commissioned up until the time when the document is brought into existence. Abraham J cited Singapore Airlines with approval in Roberts-Smith v Fairfax Media Publications Pty Ltd (No 23) [2021] FCA 1460; 157 ACSR 438 at [44] and again in DBCT Management Pty Ltd v McConnell Dowell Constructors (Aust) Pty Ltd [2021] FCA 512 at [79], but did not express a view as to whether events after the commissioning of a report could be relevant in relation to assessing purpose.

88    The proper date upon which to assess purpose will depend upon the particular circumstances of the case. Having said that, it will usually be the case that, where a party has commissioned a report from a third-party provider the relevant time to assess the party’s purpose for doing so will be at the time of commissioning. But that is not to say that evidence as to later events cannot be relevant. For example, the evidence might show that the purpose for the report changed over the period from the commissioning of the report to its provision. In Australian Securities and Investments Commission v Noumi [2024] FCA 349 the respondent, which claimed privilege over a third party report it had commissioned, accepted that the purpose for obtaining a report could evolve over time and may extend from the time a report is commissioned up until the time it was brought into existence (at [77]). Shariff J accepted the parties’ submissions that the purpose for which the report in that case was procured was to be assessed across the continuum of time leading up to the creation of the report (at [80]).

89    The question as to the proper date upon which to assess Optus’ purpose has little significance to the overall outcome having regard to the particular circumstances of this case.

90    First, Optus did not argue before the primary judge that its purpose for procuring the Deloitte Report should be assessed as at 13 July 2023 when the report was provided to Mr Kusalic and Ashurst. It cannot now raise an argument it did not run below without leave of the Court, and it did not seek leave. In any event, Optus said little or nothing to persuade us that 13 July 2023 is the proper date upon which to assess its purpose. In our view, the primary judge did not err in stating that it was “unrealistic” to assess Optus’ purpose as at 13 July 2023, as its receipt of the report on that date was a “mechanical output” of the purpose formed in October 2022: PJ [134].

91    Second, Optus did not argue before the primary judge that its purpose for procuring the Deloitte Report changed over time, and it did not make that contention before us. And there is no evidence as to any change in Optus’ purpose over time. Thus, whether Optus’ purpose is assessed in the period between 3 and 11 October 2022 (as the primary judge found to be appropriate), or as at 21 October 2022 when Deloitte issued the formal engagement letter to Ashurst (as Optus contends is appropriate), Optus’ purpose must be the same. The same applies if purpose is to be assessed as at 13 July 2023.

92    Optus, however, contends that if purpose is assessed at 21 October 2022 then it is clear that its dominant purpose is the legal purpose, because Deloitte was formally engaged by Ashurst on that date, and the terms of engagement expressly stated that the purpose of the engagement was so that Ashurst could provide legal advice to Optus.

93    The deficiency in this aspect of Optus’ argument is similar to the deficiency with its arguments on the other proposed grounds. Mr Kusalic’s evidence shows that his purpose for requesting an investigation and report by Deloitte was the legal purpose, and there is nothing to show any change in his purpose. He always had the same purpose. However, the evidence shows, and Optus accepted before us, that in fact it had multiple purposes for procuring the Deloitte Report. In those circumstances, the fact that Mr Kusalic took steps to carry into effect his purpose through Ashurst did not establish Optus’ dominant purpose. His evidence as to his purpose was just part of the evidence required to be taken into account in determining Optus’ dominant purpose. It was not good enough for Mr Kusalic’s evidence to establish that one of Optus’ purpose for procuring the report was the legal purpose. Optus needed to establish that the legal purpose was the dominant purpose, and as the primary judge explained it did not adduce adequate evidence to do so.

94    The primary judge found, correctly in our view, that the Deloitte Report was commissioned before the formal letter of engagement was issued, and he correctly identified that the purpose of the creation of the Deloitte Report was formed in the period when Optus’ CEO publicly announced the commissioning of the report on 3 October 2022 and the Board resolved to procure the report on 11 October 2022. The relevant timeframe to assess the purpose of commissioning the report was therefore between 3 and 11 October 2022.

95    However, even if, contrary to our view, the appropriate date for determining Optus’ purpose in procuring an investigation and report by Deloitte is instead 21 October 2022, we can see no error in his Honour’s finding that the evidence does not establish that the Deloitte Report was procured for the dominant purpose of legal advice or use in litigation or regulatory proceedings.

96    It follows that Optus’ proposed appeal ground 2 must be rejected.

Leave to appeal – disposition

97    The primary judge’s judgment below is not attended with sufficient doubt to warrant the grant of leave. We have made orders to refuse leave to appeal, and for Optus to pay the respondents’ costs.

Associate:

Dated:    27 May 2024

SCHEDULE OF PARTIES