Legal Precedent Set for Post-Breach Investigations as Court Rules Reports Not Protected by Privilege
In a significant legal development, the Federal Court has ordered health insurer Medibank to hand over detailed investigation reports related to its massive 2022 cyber attack that exposed data from over 10 million customers.
Federal Court Judge Helen Rofe ruled that investigation reports prepared by consulting firm Deloitte were not protected by legal professional privilege as Medibank claimed. The court found the reports served multiple purposes beyond legal advice, including improving cybersecurity and facilitating public communication.
Impact on Business Investigations
The ruling has immediate implications for how Australian businesses approach cyber security incident investigations. Many organisations previously assumed that engaging external consultants through legal counsel would protect investigation findings under privilege.
The decision suggests businesses must carefully structure post-incident investigations to ensure confidential reports are created solely for legal advice purposes, rather than serving broader operational or communications functions.
For Brisbane SMEs and larger organisations, this means reviewing existing incident response plans to properly segregate legal investigations from operational assessments. Companies may need separate consulting teams for different post-breach activities.
Broader Implications
This legal precedent comes as Australian businesses face unprecedented cyber challenges, with data breaches occurring every six minutes according to the Australian Signals Directorate.
The ruling may prompt organisations to reconsider their cyber security governance and incident response procedures, emphasising the importance of robust preventive measures rather than relying on potentially non-confidential post-incident investigations.
About Winbasic: Winbasic helps Brisbane organisations implement comprehensive cyber security strategies with expert incident response planning and security assessments. Contact us to strengthen your cyber security defences.
