The Full Federal Court’s recent decision in Medibank Private Limited v McClure [2026] FCAFC 38 is an opportune reminder of the ‘dominant purpose’ test for litigation privilege. The Court confirmed that where the legal purpose does not objectively prevail over competing purposes of substance, such as governance, remediation, regulatory engagement, and public communications, a privilege claim will fail.
Why is this important?
The decision is of particular significance for insurers, who routinely commission expert reports and valuations for purposes that may sit in the ‘grey area’ between assessing a claim and preparing for litigation in respect of it.
In New Zealand, we apply a dominant purpose test when determining whether a document is protected by litigation privilege. Medibank provides a worked example of how a court will navigate complex, layered facts to determine whether a report was truly made for the dominant purpose of preparing for litigation.
Background
In 2022, Medibank Private Limited suffered a cyber-attack that exfiltrated customer data. Medibank mobilised a legal, technical, regulatory, operational and reputational response. It engaged a law firm to provide legal guidance and to involve external advisers for an incident response and to prepare crisis communications. While Medibank’s CEO was cognisant of litigation risk, including class action risk, in those initial weeks the company was investigating what had occurred so it could notify customers, shareholders, regulators, law enforcement and government agencies.
Medibank’s lawyers engaged Deloitte on Medibank’s behalf to produce three reports: one examining the incident, one identifying root causes, and one assessing compliance with Australian Prudential Regulation Authority (APRA) Prudential Standard CPS 234.
When customers later brought ‘class action’ proceedings against Medibank in respect of the breach, they sought disclosure of the Deloitte reports. Medibank resisted, arguing that they were privileged.
At first instance, the Judge found that Medibank had not demonstrated that obtaining legal advice was the dominant purpose of the reports. The key question on appeal was whether obtaining legal advice was genuinely the dominant purpose, or whether the other governance and investigatory objectives had taken precedence.
Important considerations
Medibank argued that the Judge had misapplied the dominant purpose test by treating the existence of other purposes as destructive of privilege. Medibank highlighted that, after a major cyber incident, a company facing class actions and regulatory scrutiny must inevitably deal with lawyers, regulators, the market, and its own governance all at once.
Praising the first instance Judge’s assessment of the evidence of Medibank’s dominant purpose, the Court agreed that the direct evidence of Medibank’s Chair, CEO and General Counsel on this issue carried weight, but could not capture the whole of Medibank’s institutional purpose. While each gave evidence that the dominant purpose of the Deloitte Reports was to obtain legal advice, the Court observed that “while relevant, it is not enough that a party or its officers honestly say, or even honestly believe, that the legal purpose was dominant.”
The Court also found that an ASX announcement made at the point of commissioning the report, which described a review as serving managerial functions, indicated that the legal purpose was not necessarily the dominant one.
The report was not privileged. The additional functions of the report were too significant to be treated as incidental. Though a legal purpose was present, it was not the prevailing purpose.
Legal channels will not trigger privilege per se
A central theme in Medibank’s submissions was that the Deloitte reports were commissioned and directed by its lawyers. While the Court noted that a formal retainer is a strong indicator of purpose, simply reciting “dominant purpose” in an engagement letter does not settle the question. Otherwise, privilege would turn on how well the letter was drafted rather than on the true substance of the engagement. Courts will look past formal retainer language to assess the practical and institutional role the document was actually intended to play.
The consequences of fulfilling multiple purposes
Medibank argued that it was commercially sensible to design a single review that could serve its legal needs and regulatory interests. It argues that the first instance Judge wrongly treated this as evidence that the review was commissioned for a distinct regulatory purpose of equal weight.
The Court acknowledged that if Medibank’s lawyers had decided on a legal review and then informed APRA of it, the regulatory dimension might be viewed as practical and collateral. However, Medibank had not disclosed the review to APRA passively. Instead, it actively engaged with the regulator about the review’s scope and governance.
Separately, Board oversight supported the conclusion that the legal purpose did not prevail. While Board involvement was not itself fatal to privilege, the fact that the review was commissioned, structured and reported within a framework of Board oversight was indicative of its broader commercial purpose.
Key takeaways for insurers
- The way a report is framed is important, but not decisive: Public statements made at the point of commissioning, the extent of involvement of external bodies about the review’s scope, and the integration of the review into collateral purposes will likely be taken as evidence of purpose and may overwhelm subjective intent. Language that appears to prioritise non-legal objectives risks undermining a privilege claim.
- Ring-fence legal reports: Where possible, maintain a clear distinction between a report that is commissioned for litigation and one commissioned for any broader or overlapping purposes. Integrating a commissioned report into board-level reporting, remediation tracking, or regulatory response plans risks converting the legal purpose into one of several objectives where it is not the dominant purpose.
- Document institutional purpose broadly: Ensure that internal records and communications consistently reflect the understanding of a dominant legal purpose.
