McClure v Medibank Private Limited [2025] FCA 167

1. That the ASX/PR purpose was an important purpose can be seen from the numerous public references to the commissioning of the external review and appointment of Deloitte made by Medibank in its ASX announcements, communications with employees and millions of customers and health partners. Each of the public statements was approved by the Board of Medibank, or a Medibank executive prior to publication. In each of these public statements, Medibank stated that Medibank, not its lawyers, commissioned the external report, and that the purpose of the external review was to protect and safeguard customers. That the ASX/PR purpose continued to be an important underlying purpose of the external report can be seen from the fact that Medibank continued to publicly reference that purpose whilst Deloitte was undertaking the review, and following receipt of the first of the Deloitte Reports.
2. Within a day of the Board deciding to commission an external review on 6 November 2022, and before the identification of the external reviewer and engagement of Deloitte, Medibank was communicating that decision to its shareholders via the 7 November 2022 ASX Announcement, reviewed by Ms Ramsay and approved by the Board. The public purpose given in the ASX announcement for the commissioning of the external report was twofold: the protection of customers, and to learn from the Cyber Incident in order to strengthen Medibank's ability to safeguard customers:

... Medibank is committed to taking decisive action to protect our customers, our people, and the community in relation to the cybercrime perpetrated against its customers last month. ...

Medibank will commission an external review to ensure that we learn from this event and continue to strengthen our ability to safeguard our customers ...

Medibank commits to sharing the key outcomes of the review, where appropriate...

(Emphasis added.)

1. The applicants contend that the content of this 7 November 2022 ASX Announcement is cogent evidence that, from the outset, Medibank's dominating purposes for the engagement of Deloitte and the Deloitte Reports were some or all of the Operational purpose, the Governance purpose, and the ASX/PR purpose. They submit that the APRA purpose also assumed a prominence in Medibank's rationale for Deloitte's engagement as by mid-November 2022, it became clear to the business that APRA would require the review to fulfil APRA's requirements - as well as Medibank's - if Medibank were to avoid APRA undertaking its own independent review. APRA's role in setting the scope of the external review is discussed in the next section.
2. Mr Wilkins' evidence in relation to the 7 November 2022 ASX Announcement was that "it was important to [him] that we got the message out that we were taking appropriate steps to understand what had occurred so that we could remedy any issues that may be revealed to us and share those issues within the constraints of any legal advice taken by us". Both Mr Wilkins and Mr Koczkar accepted that a purpose of the Deloitte external review was to learn from the Cyber Incident in order to strengthen Medibank's ability to safeguard its customers.
3. There were many other Medibank public references to the fact that an external report had been commissioned for the purpose of learning from the Cyber Incident and strengthening Medibank's ability to safeguard customers, including at the AGM on 16 November 2022, the day after Deloitte's engagement. Mr Wilkins and Mr Koczkar both highlighted the engagement of Deloitte in their speeches at the AGM on 16 November 2022. In each of their public statements the purpose given for commissioning the external report was said to be to learn from the Cyber Incident in order to strengthen Medibank's ability to safeguard its customers. See the AGM statements of Mr Wilkins and Mr Koczkar extracted at [98] above.
4. The same day as the AGM, Mr Koczkar sent an email to all Medibank employees (around 3750 people), which is extracted above at [99], stating that the purpose of the external report was to ensure that Medibank learnt from the Cyber Incident, and strengthened its ability to safeguard customers. Mr Koczkar, and other executives, reiterated that purpose in the many emails to Medibank's customer cohort and healthcare partners sent shortly after the AGM. The tenor of Medibank's public announcements and other public statements never varied, always giving the purpose for commissioning the external review as being to learn from the Cyber Incident and to strengthen Medibank's ability to safeguard customers. No public mention was ever made as to the purpose of the external review being for the purposes of legal advice or providing legal assistance, or as to the external review being commissioned by Medibank's lawyers, rather than Medibank itself.
5. On 1 December 2022, Medibank published a letter to its customers in media publications across Australia, which is extracted above at [106]. Under the heading "Strengthening our ability to safeguard your data", the letter stated:

We've commissioned Deloitte to carry out an external review of recent events. This review will help inform the changes we make as a company and, where we can, we will openly share its findings with the broader community. It's not just data that's affected. It's people. People we care for, and whose health and wellbeing remains our absolute focus.

1. The Medibank 2023 half year results released on 23 February 2023 in a section headed "External review/OAIC investigation" noted as the first dot point: "Deloitte conducting an external review, and that review is ongoing". The Deloitte external review was also mentioned in the "Highlights" section of an Investor Presentation on the half year results released the same day under "Cybercrime event impacts - our focus remains on our customers". The ongoing Deloitte review was reported under "What we have done in response".
2. The 28 April 2023 ASX Announcement (approved by the Board) announced that Medibank had been provided with Deloitte's findings from its external review, reporting that a number of Deloitte's recommendations to enhance Medibank's IT processes and systems had already been implemented (see above at [159]). Medibank stated that it intended to implement all the recommendations from the review which were not already implemented. Mr Koczkar gave evidence that Deloitte identified - and directly informed Medibank about - areas of its IT systems that still needed to be enhanced.
3. Mr Wilkins confirmed that Deloitte in its reports had, in fact, made recommendations and opined on the enhancements that needed to be made to Medibank systems and the adequacy of those systems. Mr Wilkins is quoted in the 28 April 2023 ASX Announcement as saying "[o]ur focus has been to ensure that we closed down the attack path and enhance our systems and processes to provide our customers with the security they expect and deserve". The 28 April 2023 ASX Announcement concludes with Mr Wilkins saying "[f]rom the beginning of this cybercrime, Medibank has continued to prioritise and support the needs and health of our customers and to ensure the earliest possible resumption of normal business operations".
4. Mr Koczkar also made reference to the Deloitte findings from the external review in his Presentation to the Macquarie Australia Conference and an FY23 outlook update dated 2 May 2023. Under the heading "Key point", Mr Koczkar notes "Deloitte made recommendations to enhance Medibank's IT processes and systems, a number of which have already been implemented".
5. The repeated public references to Medibank's commissioning of an external review, the engagement of Deloitte to carry out that review, and the stated public purpose of such review being to learn from the Cyber Incident so as to strengthen Medibank's ability to safeguard its customers is contrary to the legal purpose being the dominant purpose. As the applicants observe, if the Board was really only concerned with the legal purpose and envisaged that Deloitte's engagement and any reports resulting from the external review were and would be treated as privileged, there was no need for Medibank to refer to the external review at all in any public communications. The reference to the external review and its ASX/PR purpose was clearly intentional as it was repeated in many of the public communications, all of which had been reviewed within Medibank before publication. Nor did any of the public statements include any qualification that the external review was recommended by Medibank's lawyers or that it was being done for the purposes of providing legal advice and/or assistance.
6. Medibank's repeated public references to the external review conducted by Deloitte is in marked contrast to the treatment of the work of the other Cyber Experts, such as Threat Intelligence and CrowdStrike, which Medibank contends were also engaged for the purposes of KWM providing legal advice and assistance. Deloitte is the only consultant identified in the public communications, and the Deloitte Reports are the only external review identified in those communications.
7. This purpose of the external report - to enable Medibank to learn from the Cyber Incident and to strengthen Medibank's ability to safeguard its customers - was a forward-looking purpose. In this sense, the Deloitte review would identify and make recommendations to Medibank as to enhancements and changes that needed to be made to Medibank's IT processes and systems in order to strengthen its security environment to better safeguard its customers' data in the future. In contrast, the legal purpose was a backward-looking purpose, whereby the Deloitte Reports would translate the technical IT data about the Cyber Incident into a form intelligible to the lawyers in order for the lawyers to provide Medibank with legal advice or assistance in relation to legal issues associated with the Cyber Incident.
8. Each of the Medibank public communications also contained a commitment to share the results of the external review - a commitment inconsistent with the preservation of legal professional privilege. However, Mr Wilkins downplayed that commitment, conceding that despite the repeated public statements about Medibank sharing the results of the external review, at no time did he intend to release or "share" the results of the external review into the public domain.

1. The APRA purpose was another important purpose to Medibank.
2. APRA is the prudential regulator for Medibank. Medibank first notified APRA of the Cyber Incident on 13 October 2022. Since the next week, APRA held twice weekly meetings with Medibank at which Medibank provided updates about Medibank's response, impacts and business continuity plans.
3. Mr Koczkar and Mr Wilkins gave evidence that a key concern for Medibank was to avoid the need for APRA to conduct its own review of the Cyber Incident. It was highly likely that unless Medibank conducted a review that accorded with APRA's requirements, the regulator would conduct its own investigation, potentially as a precursor to enforcement action. Mr Koczkar considered the ideal situation to be one review as there was "a lot of time and energy needed to respond to the questions in a review" and it would be "expedient if the one review could satisfy [APRA's] requirements as well".
4. Medibank sought APRA's approval before it announced the engagement of Deloitte as the external reviewer at the AGM, in particular that it had consulted APRA about the appointment. Medibank also sought APRA's approval of the draft Deloitte Engagement Letter and the scope of the review to be undertaken pursuant to that engagement. As noted at [154], on 19 December 2022, Mr Spencer of Medibank provided to APRA a copy of the draft KWM engagement letters in respect of the RCA Report and CPS 234 Report so that APRA could confirm that it was satisfied with the scope of the review.
5. In framing the terms and scope of Deloitte's engagement to undertake the external review, Medibank was concerned to ensure that it met the requirements and expectations of its regulator, in order to provide the regulator with the information it required and so as to avoid the regulator undertaking its own separate review. APRA publicly confirmed its role in informing the scope of the external review in order "to ensure that it will meet APRA's requirements", noting that the review would examine "the incident itself, control effectiveness and the response of Medibank".
6. Mr Wilkins confirmed that it was his understanding that APRA had informed the scope of the external review to ensure that it met APRA's requirements, and that APRA was going to use the findings of the external review as part of its consideration as to whether further regulatory action might be needed against Medibank. Mr Wilkins' understanding accorded with APRA's public statement that it "would consider whether further regulatory action is needed when findings of the [Deloitte] report become clear".
7. The applicants point to the "striking coincidence" that the three stages of assistance which KWM required aligned almost precisely with the same matters that APRA wished to have reported to it. The overlap is no coincidence given the extent of Medibank's communications with APRA outlined above, APRA's role in informing the scope of the review, and the Chair and CEO's aim for there to be only one external review, that undertaken by Deloitte, and to avoid a separate APRA review.
8. Mr Koczkar agreed (consistently with APRA's public statement) that APRA expected Medibank to use the findings of the external review to undertake remediation actions and consequence management, including assessing executive remuneration impacts. Mr Koczkar further agreed that the Deloitte Reports were apt to inform whether there should be remuneration consequences within Medibank as a result of the Cyber Incident as that fact had been communicated in emails to customers.
9. The only way the APRA purpose could be satisfied was for APRA to be given a copy of the Deloitte Reports, and for APRA to be able to fulfil its regulatory obligations and duties based on the matters in the reports. APRA publicly confirmed that it had informed the scope of the external review to be conducted by Deloitte in the 28 November 2022 APRA Release, noting Medibank's constructive response to date and that "APRA will consider whether further regulatory action is needed when findings of the report become clear". Medibank in its 28 November 2022 ASX Announcement, noted that it had been in regular consultation with APRA and stated that as "part of our engagement, Medibank consulted with APRA on the scope of the external review we commissioned Deloitte to undertake". As noted previously, copies of the draft Deloitte Engagement Letters for the RCA and CPS 234 Reports were provided to APRA before being sent to Deloitte in order for APRA to be satisfied as to the content.
10. The details of the communications between Medibank and APRA relating to the commissioning and scope of the external review are set out in section 4.3 above. It is notable that most of the emails discussing the scope of the external review did not copy in any KWM lawyer. Nor was it discussed in the communications that one of the purposes of the external review was to ground legal advice. Further, as the applicants contend, KWM played only a minor role in the selection of the external expert or in determining the scope of their engagement, with APRA taking a leading role in determining the scope, at least in so far as required to meet the APRA requirements.
11. According to Mr Koczkar, the "ideal situation" for Medibank was for only one review to occur:

... there's a lot of time and energy needed to respond to the questions in a review, so we were doing our review, and then given that APRA was likely to do their review, we thought it would be expedient if the one review could satisfy their requirements as well ... given we were doing review anyway, that was why we were keen to avoid two reviews, to make sure they were satisfied with the scope.

1. An email from Mr Koczkar to Mr Carmody of APRA on 27 November 2022, stated:

Finally, I wish to reiterate Medibank's commitment to working constructively and cooperatively with APRA to ensure we meet APRA's expectations. As always, if you have other suggestions as to how we can achieve this objective, then I would be very appreciative to hear those from you.

1. Mr Wilkins agreed with the proposition that the commissioning of the external review was also apt to help reassure the regulator that Medibank was taking appropriate action. He accepted that his intention was that Medibank would do what it could to ensure that Deloitte's review met APRA's expectations and thus avoid a further review.
2. To further Medibank's aim of avoiding a separate APRA review, APRA was consulted on the terms of reference for the external review. APRA made suggestions for additions to the scope of the external review. APRA was concerned that the review be independent, and questioned whether Medibank's Internal Audit team, as the team leading the external review could maintain its independence given that an aspect of the external review would consider (at APRA's insistence) compliance with CPS 234, for which 'Internal Audit' was partially responsible from a compliance perspective. This led to a governance change with the internal lead being reassigned from Internal Audit. Ms Phillips informed Mr Young - in the only apparent reference to KWM - that "the proposed governance structure will see Deloitte have direct access and reporting into the Medibank Board, and Deloitte will be working through KWM for outcome discussions and reporting".
3. Mr Koczkar and Mr Wilkins met with Mr Carmody and Ms Smith of APRA on 25 November 2022 to discuss the proposed terms of reference of the external review. At that meeting, Mr Koczkar and Mr Wilkins proposed, and APRA agreed, that the review would be sequenced, dealing first with post-incident review (the PIR Report), secondly with a root cause analysis (the RCA Report), and then finally with Medibank's compliance with CPS 234 (the CPS 234 Report). It was for this reason that the scope of Deloitte's engagement was refined and expanded in the terms of the engagement letters dated 11 January 2023.
4. Mr Koczkar's evidence was that on 25 November 2022, he and Mr Wilkins discussed with Mr Carmody and Ms Smith putting in place arrangements so that Medibank could maintain privilege.
5. According to Mr Koczkar it was agreed during the 25 November 2022 meeting that Medibank "would provide APRA with the results of its external review on the basis that Medibank maintained its claim of [legal professional privilege] over such material". Mr Koczkar did not say that he articulated the basis of any such claim to APRA. Legal professional privilege was not mentioned in correspondence between Medibank and APRA until Mr Huijsen's 8 December 2022 Email which noted "APRA legal to meet with [Medibank] legal to discuss assurances APRA can provide around legal professional privilege".
6. In his email to Mr Koczkar of 26 November 2022 (set out at [135] above), Mr Carmody proposed that there be "tri-partite" meetings which would allow APRA to have direct engagement with the third-party review. Mr Carmody considered that such meetings would help ensure that APRA's scope items were adequately addressed and reduce the risk that anything was lost in translation. Mr Koczkar agreed to the proposed tri-partite meetings in an email the next day. Neither Mr Carmody's email of 26 November 2022 nor Mr Koczkar's email of 27 November 2022 made any mention of maintaining privilege. Five tri-partite meetings between Medibank, APRA and Deloitte took place during the course of the Deloitte engagement.
7. Ms Ramsay was "keen to ensure, if possible, that part of Medibank's proposed external review would address APRA's desire to understand the circumstances of the Cyber Incident, and that outcomes would be shared with APRA. Ms Ramsay's correspondence with APRA was explicit about Medibank's priority to meet APRA's expectations. Those expectations would include being able to use the information in the external report for APRA's regulatory purposes. Ms Ramsay's email of 9 December 2022 to Mr Huijsen stated:

Thank you again for your time yesterday, and for clarifying the areas APRA requires to be in scope of the external review to be conducted by Deloitte. Medibank appreciates your engagement and input and wishes to ensure that the scope of the reviews meets APRA's expectations.

In response to the points you make in your email:

• Thank you for acknowledging and agreeing to our approach to managing the commissioning of the various reviews. As discussed, Medibank will be engaging Deloitte to perform the work under three separate engagements and each engagement will result in a standalone report. AS [sic] you note, the 3 reviews are colloquially known as: IT Incident Review (which Deloitte has already commenced), Root Cause Review and Compliance with CPS234.

...

Once again thank you for your time yesterday, and I wish to reiterate Medibank's commitment to working constructively and cooperatively with APRA to ensure we meet APRA's expectations.

1. As can be seen from Ms Ramsay's 9 December 2022 email, by this time, the external report had evolved into three separate reports, the most relevant one to APRA being the "Compliance with CPS234" report. However, APRA received copies of all three Deloitte reports.
2. An agreed privilege protocol between Medibank and APRA was entered into on 15 February 2023 expressed in the 15 February 2023 Letter, well after the external review had been commissioned. As the applicants note, that protocol could not and does not retrospectively establish the existence of a dominant legal purpose for the commissioning of the external review undertaken by Deloitte: Robertson at [161] (per Beach J).
3. APRA was provided with copies of all three Deloitte Reports, not just the CPS 234 Report. The final copy of the CPS 234 Report was provided to APRA by KWM on 28 June 2023, two days after APRA had sent a letter to Medibank about action it would take following APRA's review of the Cyber Incident.
4. The close involvement of APRA in the informing the scope of the external review, support the conclusion that the APRA purpose - to avoid a separate APRA external review - was a very important purpose to Medibank. The hands on involvement of APRA in developing the scope of the external review, the multiple tri-partite meetings allowing APRA - Medibank's regulator, and a potential protagonist in penalty proceedings against Medibank over the Cyber Incident - direct access to all the Deloitte Reports was antithetical to ensuring maintenance of that privilege on the basis that the dominant purpose for commissioning the Deloitte Reports was the provision of legal advice or assistance.

1. It was the Board of Medibank that resolved to approve the appointment of Deloitte to conduct an external review of the Cyber Incident. During the 15 November 2022 Board meeting, where it was resolved that Deloitte would be appointed to conduct an external review, no lawyers (other than Ms Ramsay) attended the meeting, with the language of the Board resolution also silent to the fact that Deloitte was to be engaged by KWM for the purpose of the review. The Board meeting minutes redact any discussion of the reasons for the external review. Mr Gatto did not recall being informed or consulted about the Board resolution.
2. According to Mr Wilkins the Board "wanted to have a [...] unvarnished view of what had occurred_,_ and [they] felt that it was important that they had that access to the [B]oard to be able to report that". Mr Wilkins also met with the people from Deloitte and offered that Deloitte should contact him personally should there be any issues with respect to access to information or assistance to conduct the review.
3. Mr Wilkins agreed that he had expressed a preference on or around 6 November 2022, that it be clear that the Board was commissioning the external review, rather than management, to demonstrate how seriously the Board was treating the Cyber Incident and to ensure a level of separation between the external review and management. Mr Koczkar shared the same view.
4. At the same time as approving the appointment of Deloitte, the Board appointed Ms Ramsay to liaise with KWM and Deloitte in relation to the review. To this, Mr Wilkins' evidence was that Ms Ramsay was appointed primarily in her role as Group General Counsel but that, in circumstances where Ms Ramsay is also the Company Secretary of Medibank (in addition to being the Group General Counsel), he also thought Ms Ramsay was the most appropriate person to take carriage of this matter as it would involve "administrative" tasks.
5. Mr Wilkins personally spoke with either Mr Blatchford or Mr Carvouni of Deloitte prior to Board meetings at which Deloitte were scheduled to present a report so that they could "give [him] an update on what they were going to talk about". Mr Wilkins confirmed that he met with Deloitte representatives on several occasions prior to Board meetings and before Deloitte delivered each of the Deloitte Reports; and that he did so without any lawyers present. Mr Wilkins confirmed that in these meetings, Deloitte briefed him on what matters Deloitte were going raise at the meetings.
6. Deloitte attended meetings of the Board to brief directors on the progress of their review and to address their reports on around five occasions. Mr Wilkins confirmed that Deloitte reported directly to the Board on its findings, not via KWM. The Board agenda and Board minutes reveal - confirmed by Mr Wilkins - that many non-lawyer and non-Board member management employees of Medibank attended the meetings and were present for Deloitte's presentations on each of the three Deloitte Reports. Mr Wilkins also had a "service quality call" with the Chair of Partners at Deloitte, Mr Tom Imbesi, in which Mr Imbesi asked for "feedback on the quality of Deloitte's work".
7. The applicants submit that this evidence indicates that the Board, or at least, Mr Wilkins, contemplated that the Board would always have a function in, and even ultimately oversight of, Deloitte's engagement. As such, the applicants note that it may be imputed that the Board sought the Deloitte Reports for a Governance purpose in addition to the ASX/PR purpose, the APRA purpose and the legal purpose.
8. In addition to the multiple public statements as to the purpose of the external review being to safeguard its customers' information discussed in 7.5.1 above, I consider that the following factors further tend against the dominant purpose for the commissioning of the external review being for the legal purpose:
   • the Board's desire for an unvarnished view of what had occurred, rather than unvarnished legal advice;
   • the Board's close oversight of the external review, including the personal attention and intervention of the Chair of the Board;
   • the direct reporting by Deloitte to the Board rather than via KWM;
   • the pre-Board meeting briefings with the Chair of Medibank; and
   • the Board's desire to be seen by its stakeholders (shareholders, customers, health partners) to be treating the Cyber Incident seriously.

7.5.4 Mr Gatto's evidence as to the legal purpose

1. Mr Gatto gave several reasons why "KWM required Deloitte to investigate the relevant matters".
2. The first reason might be described as a "technical translation" reason. Because of the technical nature of the cyber security systems and documents created by those systems, Mr Gatto considered that it was important that KWM obtain a fulsome understanding, in plain English, of the facts and circumstances of the Cyber Incident in order to be able to advise Medibank in relation to the legal issues it was confronting and to be able to effectively represent Medibank in the potential legal proceedings, including briefing counsel.
3. The technical information provided by Medibank's internal cyber security team was in the form of raw technical data, and Mr Gatto considered that Medibank's internal cyber security team had little capacity to provide technical assistance with interpreting the technical information for KWM, given their focus on containing the Cyber Incident, then remedying the IT systems after the Cyber Incident.
4. Second, Mr Gatto considered it important to understand what information had been accessed and removed to ascertain the extent of Medibank's potential legal exposure to affected customers. He also expected that it would be important to Medibank's defence in potential legal proceedings, and to advising Medibank in relation to the risk of any ongoing and continuing non-compliance with Medibank's legal obligations following the Cyber Incident.
5. Third, Mr Gatto considered that Deloitte's review of whether the enhancements to Medibank's IT systems and processes implemented since the Cyber Incident mitigated the risk of recurrence of a similar incident, and any recommendations as to further enhancements to those systems and processes, would assist KWM to understand those matters to advise Medibank in relation to the risk of any ongoing and continuing non-compliance with Medibank's legal obligations post the Cyber Incident. This was relevant to mitigating the risk of further investigations brought about by regulators, such as APRA and the OAIC, as in Mr Gatto's experience, regulators usually consider it relevant to their decisions as to what investigatory and enforcement action they will take whether there is a material risk of the same or similar thing happening again and whether steps have been taken to mitigate that risk.
6. On Mr Gatto's evidence, CrowdStrike and Threat Intelligence were also engaged by KWM to provide at the very least, assistance to KWM that overlapped with that provided by Deloitte to enable KWM to provide legal advice and assistance to Medibank in relation to the Cyber Incident and in providing responses to the OAIC own motion investigation.
7. Mr Gatto's evidence was that KWM engaged CrowdStrike directly on 18 November 2022 and later requested that CrowdStrike provide an investigation report. This was in order for KWM to understand the activities of the Threat Actor for the purposes of KWM being able to provide legal advice to Medibank in relation to those activities, including to assist with preparing notifications to the OAIC and customers under the Privacy Act, and for the purposes of the anticipated legal proceedings. Mr Gatto's evidence was that, as at 20 December 2022, Threat Intelligence had become the primary cyber security firm used by KWM to provide it with technical expert assistance so that it could provide legal advice to Medibank or legal assistance in relation to the class actions and representative complaints commenced against Medibank. That both CrowdStrike and Threat Intelligence were well placed to provide "technical translation" services in relation to Medibank's IT information tends to undermine Medibank's contention that the provision of such services by Deloitte, in order for KWM to provide legal advice or assistance, was the dominant purpose for the external report being commissioned.
8. Mr Koczkar also gave evidence that the purpose of the external review was to translate the technical information into something that the Board and Medibank's lawyers could understand. Mr Koczkar explained that the reports that had been prepared by Medibank's in-house IT team and the various cyber experts on the Cyber Incident were quite technical in nature and difficult to understand for people not trained in IT. Mr Koczkar contemplated that "[h]aving someone external [i.e., Deloitte] come in and review what had happened and explain this to Medibank's lawyers provided the best method for the Board to understand what the Cyber [Incident] meant legally for Medibank". Mr Koczkar also referred to another purpose of the external review, as providing a means of verifying Medibank's internal investigation, although he described that purpose as "very much secondary to the primary purpose of ensuring the Board could receive advice on Medibank's legal position based on an external review of what had occurred".
9. The overwhelming need for a technical translation of the Medibank IT information in order for KWM to be able to provide legal advice to the Board does not sit comfortably with Mr Koczkar's evidence that he considered that Medibank's "internal investigation had already given us a reasonable understanding of what had occurred" and that "by this time [he] felt [he] already had a reasonable understanding of what had occurred based on Medibank's internal investigation".
10. The external review ultimately commissioned went far beyond mere technical translation of the available technical information produced by Medibank's internal IT investigations. Even if this legal purpose was an influential purpose, it could not override the ASX/PR purpose or APRA purpose. The effect was to bolster public communications which stated that the external review enabled Medibank to learn from the Cyber Incident and to better safeguard its customer data, as well as avoiding the need for a separate APRA external review.
11. Finally, Mr Gatto's evidence was that KWM required input on what was required to meet the "commensurate with" standard and other requirements of CPS 234 and whether Medibank's system met that standard. Such a purpose is inconsistent with the same report being provided to the regulator, APRA, for the purposes of assessing whether Medibank's systems were adequate to meet its obligations and whether or not to impose sanctions in respect of any deficiencies identified.
12. The applicants contend that Mr Gatto's evidence simply reflects a significant purpose perceived by him for the Deloitte Reports - namely, the legal purpose, but that is not determinative of the dominant purpose being the legal purpose. I agree.
13. I do not doubt that the legal purpose was one of the multiple purposes for which the external review conducted by Deloitte was commissioned. However, I do not consider that the legal purpose was the dominant purpose for which the external review was commissioned.

1. This document is a report from Deloitte dated 4 April 2023 titled "Post Incident Review".
2. Deloitte prepared a "Board Update" presentation for the 9 February 2023 Board meeting to inform the Board of its progress to date in the Post Incident Review. Mr Blatchford, Mr Carvouni and Mr David Boyd of Deloitte were recorded in the minutes as attending the 9 February 2023 Board meeting. The minutes also record that in addition to the Board, Ms Ramsay, the three people from Deloitte and three partners from KWM were all in attendance. In total, the meeting was attended by 14 Medibank management executives, most of whom from their titles do not appear to be lawyers, all of whom were listed as being present for the Cyber Incident update.
3. A copy of the PIR Report was sent to Mr Gatto on 4 April 2023, and the next day he sent a letter on behalf of KWM to Medibank and its Directors enclosing a copy of the Deloitte PIR Report on a confidential and privileged basis. A copy of the PIR Report was included in the Board papers for the 11 April 2023 Board meeting.
4. The PIR Report was presented to the Board by Mr Blatchford and Mr Carvouni at the 11 April 2023 Board meeting. The agenda allocated 60 minutes for the PIR Report. The minutes record that Mr Blatchford and Mr Carvouni spoke about the Report and answered questions from the Board. Mr Boyd was also present. The minutes also record that, in addition to the Board, Ms Ramsay, the three people from Deloitte and two partners from KWM, the meeting was attended by eight Medibank management executives, most of whom from their titles do not appear to be lawyers, and all of whom were listed as being present for the discussion of the PIR Report.
5. Mr Koczkar's evidence was that by the time he received the PIR Report, Medibank "had [its] own internal investigation", so when he read the PIR Report he was looking to see whether there was anything new, as much as anything else in the report. By that time, Mr Koczkar felt he had a good idea of how Medibank's systems and processes needed to be enhanced and strengthened based on Medibank's own internal investigations.
6. Mr Gatto provided a copy of the PIR Report to APRA on 12 April 2023.
7. Mr Koczkar considered it important for Medibank to update the market on the progress of Deloitte's external review. As noted above, in its 28 April 2023 ASX Announcement, Medibank confirmed that it had been provided with Deloitte's findings from its external incident review in the circumstances of the Cyber Incident, noted that a number of Deloitte's recommendations had already been implemented, and expressed Medibank's intention to implement all recommendations not already undertaken. Mr Koczkar also made reference to the findings of the Deloitte external review and its recommendations in a presentation on 2 May 2023.
8. Mr Gatto's evidence was that the PIR Report had been relied on and used by him, and other lawyers at KWM, to provide legal advice to Medibank, including in relation to legal proceedings now on foot against Medibank. For example, without waiving legal professional privilege, Mr Gatto gives examples of how the Deloitte PIR Report has been used by Mr Gatto and others at KWM (and still is being used) for the purpose of:

(1) briefing counsel;

(2) advising Medibank on its compliance with the APPs (including APP 11.1) and CPS 234;

(3) responding to OAIC notices;

(4) preparing advice to Medibank on potential third-party liability;

(5) preparing Medibank's defences in legal proceedings;

(6) identifying key issues and areas requiring further work to manage and/or mitigate Medibank's legal risks and liabilities;

(7) preparing summaries and notes on key factual and legal issues;

(8) advising Medibank on breach reporting to APRA; and

(9) advising on Medibank's engagement with APRA.

1. This document is a report from Deloitte dated 10 May 2023 titled "Root Cause Analysis".
2. On 10 May 2023, Mr Gatto sent a letter on behalf of KWM to Medibank and its Board enclosing a copy of the RCA Report on a confidential and privileged basis.
3. Mr Gatto did not attend the 16 May 2023 Board meeting at which the RCA Report was discussed due to a longstanding commitment that same day. The agenda for the meeting indicates that 60 minutes of the 90-minute meeting was allocated to the RCA Report. Mr Blatchford and Mr Carvouni spoke about the contents of the RCA Report at the Board meeting. The Board asked questions of Mr Blatchford and Mr Carvouni about the RCA Report. Mr Blatchford and Mr Carvouni provided responses to those questions and indicated that they wanted to consider making some amendments to the RCA Report to address those questions. The minutes also record that, in addition to the Board, Ms Ramsay, the three people from Deloitte and two partners from KWM, the meeting was attended by four Medibank management executives. Again, based on their titles, none of them appear to be lawyers, all of whom were listed as being present for the discussion of the RCA Report.
4. On 17 May 2023, Mr Gatto received an email from Mr Carvouni, attaching a further version of the RCA Report (being, the final version) with two minor amendments to the version provided on 10 May 2023 to address some comments and queries raised at the 16 May Board meeting. Mr Gatto then provided the final version of the RCA Report to Ms Ramsay. Later the same day Mr Gatto provided a copy of the RCA Report to APRA.
5. According to Mr Gatto, the RCA Report was used by KWM for the same purposes as set out above in relation to the PIR Report, aside from responding to OAIC notices.

1. This document is a report from Deloitte dated 23 June 2023 titled "External Review - APRA Prudential Standard CPS 234".
2. Mr Gatto received a copy of the CPS 234 Report on 23 June 2023. Later the same day, Mr Gatto sent a letter on behalf of KWM to Medibank and its Board enclosing a copy of the CPS 234 Report on a confidential and privileged basis.
3. Mr Gatto attended the Board meeting on 27 June 2023, at which the CPS 234 Report was discussed. The agenda records that 90 minutes was allocated to the CPR 234 Report, with another 30 minutes allocated to "Cyber Incident Litigation and Regulatory Matters". The minutes record that Mr John Lee and Mr Carvouni of Deloitte spoke about the contents of the report and answered questions from the Board. The minutes also record that in addition to the Board, Ms Ramsay, the three people from Deloitte and two partners from KWM, the meeting was attended by six Medibank management executives, most of whom from their titles do not appear to be lawyers, all of whom were listed as being present for the discussion of the CPS 234 Report.
4. According to Mr Gatto, the CPS 234 Report was used by KWM for:

(1) advising Medibank on its compliance with the APPs (including APP 11.1) and CPS 234;

(2) identifying key issues and areas requiring further work to manage and/or mitigate Medibank's legal risks and liabilities;

(3) advising Medibank on breach reporting to APRA; and

(4) advising on Medibank's engagement with APRA.

1. Mr Gatto provided a copy of the CPS 234 Report to APRA on 28 June 2023.
2. Mr Koczkar noted that all the Deloitte Reports are password protected within Medibank, and have only been shared with a select group of people within Medibank on a confidential basis.

1. The evidence establishes that the Deloitte Reports were commissioned by Medibank for multiple purposes, including at least the ASX/PR purpose and the APRA purpose. I accept that there may have also been a legal purpose for the commissioning of the external review, but I do not consider that the legal purpose was the dominant purpose for the commissioning of the Deloitte Reports.
2. The matters discussed above are inconsistent with the dominant purpose being a privileged purpose to enable KWM to give legal advice and assistance to Medibank.
3. For the reasons set out above, I do not consider that the legal purpose was the dominant purpose for which the Deloitte Reports were commissioned, whether the time for the consideration is at the time of the first Deloitte engagement on 16 November 2022, the date of the later engagements, after the scope of the review had been expanded, or the date on which each of the Deloitte Reports were delivered. Furthermore, I consider that the legal purpose became less dominant as the scope of the review was expanded, particularly with the involvement and input from APRA.

1. The applicants put an alternative argument in relation to the Deloitte Reports, being the waiver of legal professional privilege.
2. If I found that the Deloitte Reports had been commissioned for the dominant legal purpose, the applicants contend that Medibank's conduct in providing the three Deloitte Reports to APRA amounts to a waiver of legal professional privilege in the Deloitte Reports.
3. Further, the applicants contend that Medibank's public statements about the Deloitte Reports, in particular its 28 April 2023 ASX Announcement, amount to a waiver of legal professional privilege.
4. As I have found that legal professional privilege does not subsist in the Deloitte Reports, the issue of waiver does not arise. However, for completeness, I consider the issue of waiver below.

1. The test for waiver is whether there has been an inconsistency between what a client has done and retention of the privilege: Mann v Carnell [1999] HCA 66; (1999) 201 CLR 1 at [29] (per Gleeson CJ, Gaudron, Gummow and Callinan JJ):

What brings about the waiver is the inconsistency, which the courts, where necessary informed by considerations of fairness, perceive, between the conduct of the client and maintenance of the confidentiality; not some overriding principle of fairness operating at large.

1. In TerraCom Ltd v Australian Securities and Investments Commission [2022] FCA 208; (2022) 401 ALR 143, an independent investigation into allegations made by a former employee and which had also attracted the attention of the Australian Securities and Investments Commission led to the commissioning of a privileged report from PricewaterhouseCoopers Consulting (Australia) Pty Ltd (PwC). TerraCom had made announcements to the ASX that it had commissioned this report, including by various ASX announcements and in an open letter to shareholders. TerraCom announced that it had commissioned the investigation and, later, that it had found no evidence of wrongdoing. Justice Stewart found that privilege in the report had been waived, with this finding affirmed by the Full Court on appeal: TerraCom Ltd v Australian Securities and Investments Commission [2022] FCAFC 151.
2. In TerraCom, at [61]-[64], his Honour observed:

In my view, reliance by TerraCom on the finding in the PwC report of no wrongdoing by its CEO and CFO is inconsistent with the maintenance of the privilege that otherwise attaches to the report. TerraCom was taking advantage of that finding to deflect criticism of its officers, and itself, the effectiveness of the deflection being heightened by characterising the investigation that led to the report as an independent forensic investigation. That was to employ the findings of PwC for a forensic or commercial advantage - forensic in the sense of seeking to deflect the attention of any regulator in an investigation and commercial in the sense of maintaining the company's commercial good standing and its share price. It cannot at the same time claim that the report is privileged. That is to seek to approbate and to reprobate.

...

TerraCom submits that the disclosure of the contents of the report is so minor as to be de minimus, but I do not accept that. TerraCom said that the independent investigation concluded that the allegations against, at least, its CEO and CFO were unfounded. Regardless of what other conclusions the report expressed, that is a critical finding of vital relevance to TerraCom, which is no doubt why TerraCom repeated it publicly on a number of occasions. It is not de minimus at all.

In that regard, the voluntary disclosure of the gist or conclusion of legal advice amounts to waiver in respect of the whole of the advice to which reference is made including the reasons for the conclusion ... It has long been established that the disclosure in a summary way of only a conclusion expressed in legal advice can result in a waiver of the advice ...

(Citations omitted.)

1. The Full Court recently considered the principles relevant to the waiver of legal professional privilege in Australian Securities and Investments Commission v Macleod [2024] FCAFC 174 at [129]-[140] (per Burley, Anderson and Meagher JJ).
2. The Full Court in Macleod noted at [138] the observations of the High Court in Expense Reduction Analysts Group Pty Ltd v Armstrong Strategic Management and Marketing Pty Limited [2013] HCA 46; (2013) 250 CLR 303 that waiver in its strict legal connotation is an intentional act done with knowledge whereby a person abandons a right or privilege by acting in a manner inconsistent with that right or privilege. The High Court went on:

[30] ... In most cases concerning waiver, the area of dispute is whether it is to be implied. In some cases, waiver will be imputed by the law [Goldberg v Ng [1995] HCA 39; (1995) 185 CLR 83 at 95-96] with the consequence that a privilege is lost, even though that consequence was not intended by the party losing the privilege. The courts will impute an intention where the actions of a party are plainly inconsistent with the maintenance of the confidentiality which the privilege is intended to protect [Mann v Carnell [1999] HCA 66; (1999) 201 CLR 1 at 13 [29]].

[31] In Craine v Colonial Mutual Fire Insurance Co Ltd [(1920) [1920] HCA 64; 28 CLR 305 at 326], it was explained that "'[w]aiver' is a doctrine of some arbitrariness introduced by the law to prevent a man in certain circumstances from taking up two inconsistent positions ... It is a conclusion of law when the necessary facts are established. It looks, however, chiefly to the conduct and position of the person who is said to have waived, in order to see whether he has 'approbated' so as to prevent him from 'reprobating'". In Mann v Carnell [(1999) [1999] HCA 66; 201 CLR 1 at 13 [29]], it was said that it is considerations of fairness which inform the court's view about an inconsistency which may be seen between the conduct of a party and the maintenance of confidentiality, though "not some overriding principle of fairness operating at large."

(Footnotes inserted.)

1. Implied waiver of privilege "reflects a judgement that the conduct of the party entitled to the privilege is inconsistent with the maintenance of the confidentiality which the privilege is intended to protect": Osland v Secretary to the Department of Justice (2008) 234 CLR 275 at [45] (per Gleeson CJ, Gummow, Heydon and Kiefel JJ).
2. As Beach J observed in Robertson at [196], implied waiver is a fact-based enquiry as to whether by conduct the privilege holder has directly or indirectly put the contents of an otherwise privileged document in issue. That enquiry entails an evaluative decision based on consideration of the whole of the circumstances of the particular case, including the context and circumstances in which disclosure or use is made. The circumstances may include the nature of the matter in respect of which the privileged document was used, the evident purpose of such disclosure or use that is made and the legal and practical consequences of limited, rather than complete, disclosure.
3. In Australian Securities and Investments Commission v Australia and New Zealand Banking Group (No 2) [2020] FCA 1013, Allsop CJ surmised at [31] a touchstone test of whether a waiver of privilege has occurred:

... there is a waiver if one states: 'I have legal advice. Its substance is.' But there is no waiver if a party says what he or she believes and legal advice may be seen to be relevant to it...

1. The onus lies on the person asserting waiver to establish that there has in fact been waiver of any privilege found to exist: State of New South Wales v Betfair Pty Ltd (2009) 180 FCR 543 at [54] (per Kenny, Stone and Middleton JJ).

1. The applicants contend that inconsistency arises through Medibank's disclosure of the three Deloitte Reports to the regulator, APRA for its own advantage - to reduce the likelihood of a second external review. They submit that the inconsistency is even more stark in this case where the privilege holder shares privileged material with a regulator that can bring penalty proceedings against the privilege holder with respect to the very subject matter of the disclosed material.
2. The applicants contend that waiver arises even where, as in Goldberg v Ng [1995] HCA 39; (1995) 185 CLR 83, disclosure was on the express basis of confidence.
3. The applicants further submit that Medibank's public statements are of a different quality to those considered by the Full Court in Singtel Optus. Here, Medibank made the 28 April 2023 ASX Announcement after it had received the PIR Report. As such, there was no ambiguity as to what Medibank was referring.

1. The applicants also relied on the finding of an implied waiver in Australian Securities and Investments Commission v Noumi Ltd [2024] FCA 349. There, a PwC report was prepared and provided to ASIC in the circumstance that Noumi had been attempting to cooperate with ASIC's investigation regarding "unsaleable inventory". Noumi entered into a "Voluntary Confidential Legal Professional Privilege Disclosure Agreement" (defined as a VDA) with the regulator under which Noumi disclosed various documents (purportedly) covered by privilege at common law, including the PwC report.
2. The Full Court in Macleod recently overturned the finding of an implied waiver on the basis of a "derivative" use of the report by ASIC. The primary judge considered that the PwC report could be used by ASIC to identify witnesses, to examine the topics to be explored with them, the questions to be asked and so on. The Full Court considered that the reference to "derivative use" was a reference to how the contents of the PwC report may be used by ASIC, finding at [147] that such derivative use of information did not amount to a disclosure of that information. To the extent that it might have been, ASIC was prevented by clause 4.1 of the VDA from doing so.
3. The Full Court in Macleod observed at [150] that an information asymmetry between parties does not of itself amount to unfairness in this context. The unfairness that informs inconsistency is forensic unfairness as between the privilege holder and the privilege challenger: Macquarie Bank Ltd v Arup Pty Ltd [2016] FCAFC 117 at [29] (per Middleton, Robertson and Gleeson JJ). The Full Court in Macleod continued at [150]-[151]:

Unlike the position on the facts in Goldberg, here, no disclosure was made by Noumi to gain an advantage over the opposing party in related litigation. Indeed at [212] the primary judge explicitly found that there was no such motive in subjective terms. Nor is one apparent in objective terms. Mere relevance of the withheld material does not by itself establish an inconsistency necessary to give rise to an implied waiver; Kinghorn at [151].

To the extent that investigations and admissible evidence obtained informed the formulation by ASIC of a case against Mr Macleod, he was entitled to access such material as might be deployed against him in the case in the course of normal pre-trial processes. Whether unfairness is considered at the time of the disclosure of the privileged material (here, on 19 October 2020) or at the time the claim for privilege is made by Noumi (13 September 2023), it may be assumed that ASIC and Noumi were aware that such pre-trial processes would make information of the kind considered above available to Mr Macleod.

1. Mere relevance of the withheld material does not by itself establish an inconsistency necessary to give rise to a waiver: Director of Public Prosecutions (Cth) v Kinghorn; Kinghorn v Director of Public Prosecutions (Cth) [2020] NSWCCA 48; (2020) 102 NSWLR 72 at [151] (per Bathurst CJ, Fullerton and Beech-Jones JJ).
2. The facts of this case are very different to those in Macleod. The details of APRA's involvement are discussed above. The following matters are of particular relevance.
3. APRA had been involved since Medibank first notified it of the Cyber Incident on day one, 12 October 2022. From 21 October to mid December 2022, APRA personnel attended twice weekly meetings with Medibank at which they were kept abreast of the developments relating to the Cyber Incident.
4. It was the evidence of both the Chair and CEO that it was a key concern of Medibank to avoid a second external review undertaken by its regulator. As Mr Koczkar observed "it would be expedient if the one review could satisfy [APRA's] requirements as well". It was intended from the outset that APRA would be given a copy of the external review (ultimately three reports) for the purposes of carrying out its regulator obligations, which included its enforcement role.
5. Medibank included APRA in the external review process from the first stage. The contact between Medibank and APRA was at the top level of both entities, involving the CEO and Chair of Medibank and Ms Smith and Mr Carmody at APRA. It notified APRA of its intention to commission the external review before Deloitte was engaged. Medibank sought, and received, APRA's comments on draft scope of the external review, and the proposed external reviewer. APRA personnel attended tri-partite meetings with Medibank and Deloitte, with no lawyers present during the course of the external review.
6. Medibank and APRA issued mutual press releases as to their open and cooperative ongoing relationship. The closeness of the relationship was exemplified by the APRA's role in the scoping of the external review, their attendance at the tri-partite meetings whilst the review progressed, and APRA's receipt of all three reports on completion of the external review.
7. APRA's involvement in setting the scope of the external review and meeting with the Deloitte team conducting the external review took place well before the privilege protocol retrospectively sought to superimpose legal professional privilege before the reports were provided to APRA.
8. In the 28 November 2022 APRA Release, APRA outlined that it has informed the scope of the external review and APRA will have information regarding the findings of the report and consider whether further regulatory action would be required. Medibank's 28 November 2022 ASX Announcement affirmed that the findings of the review would be shared.
9. The contemporaneous documents which reflect Medibank and APRA's engagement with respect to the external review and the provision of the Deloitte Reports to APRA were not formalised into a VDA, like in Macleod, but were provided pursuant to a written protocol. This protocol was addressed in the 15 February 2023 Letter from Mr Huijsen to Medibank, as extracted above at [157]. This protocol also refers to discussions between Medibank and APRA on 21 December 2022.
10. APRA expressly indicated via public statements that the information in the Deloitte Reports may be used for APRA to undertake further regulatory action. In Macleod, ASIC indicated similarly that information within the report would be applied for a 'derivative use' to prosecute Mr Macleod.
11. There was nothing in the protocol (nor could there be) to stop APRA using the information and intelligence gained through its interactions with Deloitte and the Deloitte Reports themselves for its own regulatory purposes - purposes which were in direct tension with Medibank's interests in protecting its legal position.
12. Given APRA's involvement from the very beginning of the Cyber Incident and Medibank's early intention to keep APRA informed of the substance of the Deloitte Reports, it is evident that whatever information within the Deloitte Reports relevant for ARPA's purposes was always intended to be shared with it. Rather than supporting a waiver, I consider that this is consistent with my earlier conclusion as to why legal professional privilege does not subsist in Deloitte Reports.
13. In this sense, any "derivative use" of the information in the Deloitte Reports cannot be made out, as in this case, APRA's involvement in the commission of the Deloitte Reports and their respective scopes, evidences the fact that these reports were never created or commissioned to be used for a dominant legal purpose from their very inception.

1. The applicants submit that by the 28 April 2023 ASX Announcement (and all other such public statements), Medibank voluntarily disclosed the "gist or conclusion[s]" of the Deloitte Reports and what it was doing with them. It did so, if nothing else, because of the obvious forensic advantage to deflect regulatory action, and the obvious commercial advantage to assuage customer concerns that Medibank was, in its own words, "enhanc[ing] [its] systems and processes to provide [its] customers with the security they expect and deserve".
2. The applicants contend that the inconsistency lies in Medibank's use of the Deloitte Reports for the ASX/PR purpose - from before their commissioning, during the review process and after completion of the Deloitte Reports - in purporting to provide comfort to its shareholders and customers that it would do the following: learn from this Cyber Incident and strengthen its ability to safeguard customers, and share the learnings. When, in fact, Medibank had no intention of sharing any of the outcomes, and now asserts that the dominant purpose for which the Deloitte Reports were commissioned was for the purpose of providing legal advice and litigation assistance, not the protection of its customers. The applicants submit that there is an inherent inconsistency in seeking to rely on the commissioning of the Deloitte Reports in the midst of a public relations crisis and seeking to rely on privilege in trying to resist production of the Deloitte Reports.
3. Similar submissions to those made by the applicants in this case were made by the applicants in Robertson. They alleged inconsistency in Optus relying upon the Deloitte report whilst it was in the midst of a public relations crisis and then seeking to rely on privilege in trying to resist any inspection of the report itself. Justice Beach rejected the applicant's waiver argument in Robertson, concluding at [195] that none of the public statements put the contents of the otherwise privileged report in issue.
4. The applicants seek to distinguish Robertson, on the basis that the relevant statements were made before the completed Deloitte report had been received by Optus. Here, the 28 April 2023 ASX Announcement expressly confirms that Medibank "has now been provided with Deloitte's findings from [the external incident] review" and continues "Deloitte has made recommendations to enhance Medibank's IT processes and systems. A number of recommendations have already been implemented, and Medibank intends to implement all recommendations not already undertaken ...". The Chair is then quoted as saying "the Board will continue to oversee the completion of steps to implement the recommendations to enhance systems and processes even further. Following on from the discussion of the Deloitte report's recommendations, the recommendations spoken of by Mr Wilkins must be the Deloitte recommendations.
5. Only one report had been delivered to Medibank by 28 April 2023, the PIR Report.
6. In my view, by making this reference to the Deloitte PIR Report, Medibank was seeking to take advantage of its implementation of the recommendations resulting from the external incident review conducted by Deloitte to deflect criticism and enhance or maintain its good standing in the eyes of its shareholders and customers and its share price. It cannot at the same time maintain privilege in that part of the report setting out the recommendations to enhance Medibank's IT processes and systems. I consider that by making the statements in the 28 April 2023 ASX Announcement, Medibank has waived privilege in that part of the PIR Report relating to the recommendations to enhance Medibank's IT processes and systems.
7. The statements in the 28 April 2023 ASX Announcement were not casually made, they were consciously and deliberately made following consideration by at least the Board, by way of a formal ASX announcement.

1. For the reasons set out above I consider that legal professional privilege does not subsist in the three Deloitte Reports (Documents 15, 16 and 17 listed in Annexure A). I consider that the Cyber CX and Coveware Communications (Documents 1, 2, 3, 4, 5, 6, 7, 8 and 9) listed in Annexure A), CrowdStrike Reports (Documents 10 and 11 listed in Annexure A), the Threat Intelligence Reports (Documents 12 and 13 listed in Annexure A) are privileged.
2. At this stage, I will make orders that within seven days of the date hereof the parties file and serve proposed minutes of orders to give effect to these reasons.

I certify that the preceding four hundred and forty-eight (448) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Rofe.

Email from Nick Klein (CyberCX) to Cheng Lim (KWM) re: [EXTERNAL] Re: Medibank I Key ransom issues and action plan

Email from Nick Klein (CyberCX) to Cheng Lim (KWM) re: [EXTERNAL] Re: Project Opera (privileged and

Attachment to email from Nick Klein to Cheng Lim titled "Case 06064 - Coveware.pdf"

Email from Nick Klein (CyberCX) to Cheng Lim (KWM) re: [EXTERNAL] Fwd: Update on TA comms (privileged and confidential)

Attachment to email from Nick Klein to Cheng Lim titled

Attachment to email from Nick Klein to Cheng Lim titled

Attachment to email from Nick Klein to Cheng Lim titled

Attachment to email from Nick Klein to Cheng Lim titled

Attachment to email from Nick Klein to Cheng Lim titled

Report from CrowdStrike dated 12 December 2022 titled

"Privileged Investigation Report - Atlassian Crowd Analysis"

Report from Threat Intelligence dated 4 January 2023 titled "Medibank Digital Forensics and Incident Response Report"

Report from Threat Intelligence dated 23 February 2023

titled "Draft Investigation Report - Medibank Sharepoint

Email from Jonathan Prideaux of KWM to (among others)

Report from Deloitte dated 4 April 2023 titled "Post Incident Review"

Report from Deloitte dated 10 May 2023 titled "Root Cause Analysis"

Report from Deloitte dated 23 June 2023 titled "External Review - APRA Prudential Standard CPS 234"