The Full Federal Court’s decision in Medibank Private Limited v McClure FCAFC 38 confirms that whether an investigation report is protected by legal professional privilege will turn on its dominant purpose, not the fact that lawyers are involved or that the document is labelled “privileged”.

For organisations dealing with cyber incidents, internal workplace issues, regulatory inquiries or other sensitive investigations, the case illustrates how easily privilege can be undermined when a single report is expected to serve many business objectives at once. This article explains the dominant purpose test and the practical steps organisations can take to protect privilege.

What was Medibank v McClure about?

The dispute arose from Medibank’s response to its 2022 cyber incident and, in particular, whether three reports prepared by Deloitte as part of that response had to be produced in subsequent class action proceedings. Medibank argued that the reports were protected by legal professional privilege because they were commissioned for the dominant purpose of obtaining legal advice and in contemplation of litigation.

At first instance, the Federal Court rejected the privilege claim in relation to the Deloitte reports, and the Full Court refused Medibank leave to appeal that decision. The outcome turned on the Court’s assessment that the reports were not created chiefly for legal advice or litigation strategy, even though lawyers were involved and the documents were framed as part of the legal response.

What the Court decided

Medibank’s incident response involved internal teams, external lawyers, technical consultants and communications advisers, all operating under intense legal, regulatory, operational and reputational pressures. The evidence showed that the Deloitte reports were used not only for legal advice, but also for broader organisational purposes, including governance, incident response, transparency and business improvement.

The Court accepted that a document can have more than one purpose and still be privileged, but only if the legal purpose is the dominant one. In Medibank’s case, the evidence indicated a range of significant non-legal purposes. On that basis, the primary judge held that the dominant purpose test was not satisfied. The Full Court upheld that conclusion, even though it identified an error in the primary judge’s reasoning on waiver; that error did not affect the core finding on purpose.

Ultimately, the result is fact-specific, but it shows the level of scrutiny courts will apply to privilege claims over multi-purpose investigation reports.

How courts decide if your report is privileged: the dominant purpose test

Legal professional privilege protects confidential communications made for the dominant purpose of obtaining legal advice or preparing for litigation. When a report has several purposes, the court asks, objectively, which purpose was ruling or most influential when the report was commissioned and prepared, rather than focusing on how it was later used.

That has clear implications for modern investigations. If a single report is intended to serve legal, regulatory, operational and reputational functions at once, it becomes harder to show that legal advice was the dominant purpose. That, in turn, can significantly weaken a later privilege claim. This is especially relevant in cyber incidents, internal workplace investigations and crisis responses where it seems efficient to produce “one report for many audiences”.

Practical lessons for organisations

For government, corporate and institutional clients, the key lessons from Medibank v McClure are practical rather than novel.

1. Involve lawyers early and define the legal purpose clearly

Engage legal advisers at the outset and record the legal purpose of the investigation in engagement letters, instructions, investigation plans and board papers. Make it clear that the primary reason for commissioning particular work is to enable legal advice or to prepare for litigation risk, where that is the case.

2. Align documents with the asserted purpose

Ensure that commissioning documents, terms of reference, interview scripts, internal emails and board materials are consistent with the stated legal purpose. Inconsistencies in language or emphasis can be used to argue that legal advice was only one of several purposes, rather than the dominant one.

3. Consider separate streams or reports

Where there are strong operational, governance or communications needs, consider running a separate non-privileged workstream alongside a privileged legal review. For example, a technical or operational report may be prepared for management and regulators, while a separate, legally privileged advice or analysis is prepared for the purposes of legal advice and litigation strategy.

4. Control use and disclosure of privileged material

Avoid using privileged reports as general management or communications documents. Circulating them widely, or referring to their contents in public statements, regulatory disclosures or stakeholder communications, can increase the risk that privilege is lost or found never to have existed. Take advice before sharing or summarising a privileged report outside the core legal and executive team.

5. Design and maintain privilege – do not assume it

Privilege should be treated as something that is carefully designed and maintained throughout the life of an investigation, not something that automatically attaches because lawyers are copied on emails or named in an engagement letter. The way the work is conceived, documented, executed and communicated will all be relevant.

Gilshenan & Luton regularly advises government agencies, corporate entities and institutional clients on structuring investigations in a way that balances transparency, regulatory expectations and the preservation of legal professional privilege.

Why Medibank v McClure matters

For legal teams and decision-makers, Medibank v McClure underlines that privilege strategy must be built into crisis planning from the outset. Once an investigation report has been used for broad operational, governance or public-facing purposes, it may be too late to preserve or assert privilege over that report.

If privilege is lost, detailed analysis of your systems, decision-making and vulnerabilities may have to be produced in litigation, to regulators, and possibly to other stakeholders. That has obvious consequences for exposure, reputation and the ability to manage parallel proceedings such as class actions, regulatory enforcement, disciplinary processes and coronial or other inquiries.

Each investigation is different. Organisations facing a cyber incident, workplace complaint or regulatory inquiry should seek specific advice on how best to structure their investigations and reporting to manage privilege risks in their particular context.

Not sure whether your investigation report will attract legal professional privilege? Speak to Gilshenan & Luton's Brisbane team before the work is commissioned.

Contacting Gilshenan & Luton Lawyers

📞 07 3361 0222  (24/7)

📧 gnl@gnl.com.au