Privilege in third-party reports: lessons from recent case law on establishing and preserving your privilege claim

While the principles for determining whether a third-party report is subject to legal professional privilege, and what amounts to a waiver of that privilege, are well settled in Australia, there have been a number of decisions in recent years that serve as helpful reminders about steps that should be taken to ensure that privilege is not inadvertently lost – whether by referring to the report in media releases or ASX statements, or by voluntarily disclosing it to a regulator.

While the principles for determining whether a third-party report is subject to legal professional privilege, and what amounts to a waiver of that privilege, are well settled in Australia, there have been a number of decisions in recent years that serve as helpful reminders about steps that should be taken to ensure that privilege is not inadvertently lost – whether by referring to the report in media releases or ASX statements, or by voluntarily disclosing it to a regulator.

When will a third-party report be privileged?

A third-party report commissioned in a crisis will only be subject to legal professional privilege if it was sought or prepared for the dominant purpose of the client obtaining legal advice, or for use in litigation that is anticipated or has been commenced.

Where a report has been prepared for multiple purposes, the party asserting privilege has the onus of establishing its dominant purpose by adducing specific evidence to prove that the dominant purpose was a privileged purpose. The privileged purpose must be the "ruling, prevailing or most influential purpose" – it will not be sufficient for the privileged purpose to be a substantial purpose or one of two purposes of equal weight.

The relevant time to assess purpose depends on the circumstances – it can often be at the time of commissioning the report, but in some cases where there is a privileged purpose at the time of commissioning the report, it may also be necessary to assess whether that purpose changed leading up to the creation or issuing of the report.

The Full Federal Court decision in Singtel Optus Pty Ltd v Robertson [2024] FCAFC 58 considered whether a forensic investigation report prepared by Deloitte for Optus following a significant cyber-attack was protected by legal professional privilege. This decision was a critical reminder that establishing privilege over a third-party report requires more than an assertion by in-house counsel that the report was sought for legal purposes.

Similarly, in McClure v Medibank Private Limited [2025] FCA 167 (upheld on appeal) the Court considered whether certain technical reports prepared by experts, including three reports by Deloitte, for Medibank following a cyber-attack were privileged. The Court found that certain reports had been prepared for the dominant purpose of obtaining legal advice, while the three Deloitte reports were not privileged because the public relations and APRA purposes were at least equally dominant (if not more so) than the privileged purpose.

Referring to third-party reports in media releases or ASX statements

When responding to a crisis, there can be a desire to make a proactive statement about the company's conduct or state of affairs to dispel any concerns or reports in the media. This can extend to referring to a third party or independent report in ASX statements or media releases to indicate that there is a strong foundation for the company's position.

Care needs to be taken when referring to privileged reports, or describing their findings, in any public statements to ensure that privilege over the report is not being waived, which would result in third parties (such as the regulator or class action plaintiffs) being able to access the report.

Privilege will be waived where:

• the "substance, gist or conclusion" of the privileged report is disclosed; or

• the substance or effect of legal advice has been deployed for a forensic or commercial purpose.

In ASIC v TerraCom [2022] FCA 208, for example, a statement in an ASX announcement to the effect that an independent forensic investigation had found no evidence of wrongdoing by its CEO and CFO was held to be a clear disclosure of the conclusion of the privileged report.

More recently in Korea Midland Power Co Ltd v ACIRL Quality Testing Services Pty Ltd (No 3) [2026] FCA 1019, the Federal Court considered the extent to which privilege was waived over a McGrathNicol report that investigated alleged misconduct involving certificates of analysis in ALS Limited's laboratories. The report was privileged, but ALS had issued an ASX announcement that disclosed two key findings: first, that approximately 45 to 50% of certificates of analysis had been manually amended without justification since 2007, and second, that no evidence of bribery or third-party payments involving ALS staff had been found.

Goodman J held that by disclosing those findings in the ASX announcement, ALS had waived privilege over the subject matter of those findings. His Honour held that waiver as to one part of a protected communication will usually result in waiver as to the rest of the communication on the same subject matter, because partial disclosure risks creating an inaccurate or misleading perception in the mind of the opposing party. Having inspected the report, the Court found that substantially the whole of it addressed the waived subject matter, such that disclosure of the entire report (subject to limited redactions on a discrete topic) was necessary to avoid creating an inaccurate perception of what had been disclosed. The Court ordered production of the report with only narrow redactions permitted over a small number of paragraphs dealing with a separate subject matter.

Voluntary disclosure of third-party report to a regulator

There can also be a desire to provide a privileged report to a regulator to either show voluntary cooperation with an investigation or show that there is a strong foundation for the company's position.

It is possible to reach an express agreement with a regulator, before any such disclosure, that the report is being disclosed for a limited purpose and is to remain confidential. For example, ASIC commonly uses a voluntary disclosure agreement (VDA) in its investigations, in which a company agrees to provide privileged material to ASIC on the basis that the disclosure amounts to a limited waiver of privilege to assist ASIC, but does not amount to a broader waiver of privilege at large.

The protection offered by the VDA regime was affirmed by the Full Federal Court in ASIC v Macleod [2024] FCAFC 174, where the Court found that Noumi Limited (formerly Freedom Foods Group) had not waived privilege in a PwC investigation report by voluntarily providing it to ASIC under a VDA. The primary judge had found that privilege was waived because the terms of the VDA permitted ASIC to use the information in the report in a "derivative way" - for example, by using its contents to identify witnesses, formulate examination questions, and shape its investigation. The Full Court disagreed, holding that derivative use of information does not amount to disclosure of that information because the VDA expressly prohibited ASIC from disclosing the report's contents, and the mere fact that ASIC could use the information to inform its regulatory response did not render Noumi's conduct inconsistent with the maintenance of confidentiality.

The Full Court also rejected the argument that "unfairness" to a co-defendant (Mr Macleod, who did not have access to the report) could itself establish waiver. The Court emphasised that waiver requires inconsistency between the privilege holder's conduct and the maintenance of confidentiality, not merely an information asymmetry between parties to litigation. Since Noumi had not deployed the report to gain a forensic advantage over Mr Macleod in related proceedings, no waiver was established.

Similarly, in Credit Suisse Virtuoso SICAV-SIF v Insurance Australia Limited (Privilege Hearing) [2026] FCA 1051, Lee J found that Credit Suisse had not waived privilege in Deloitte investigation reports by disclosing them to financial regulators in Switzerland (FINMA), Luxembourg (CSSF), Hong Kong (HKMA) and the United Kingdom (FCA). Marsh had argued that by providing the reports to regulators (particularly the FCA, which refused to accept all confidentiality conditions proposed by Credit Suisse) privilege had been abandoned. Lee J rejected that submission, and held that the question was not whether the privilege holder retained complete control over every conceivable future use of the reports, but whether, viewed objectively, it acted inconsistently with maintaining confidentiality. Relevant considerations included that Credit Suisse repeatedly asserted privilege, supplied the reports under statutory secrecy regimes, and sought practical restrictions on copying, retention and onward dissemination.

Lee J also observed that commercial parties and regulators frequently deal with confidential material on a limited basis, and that the existence of statutory exceptions to confidentiality obligations does not automatically mean the privilege holder has acted inconsistently with maintaining privilege merely by participating in that regulatory process.