Full Court’s narrowing of legal professional privilege at common law: Medibank v McClure & Mastercard v ACCC
 
In Medibank Private Limited v McClure [2026] FCAFC 38, the Full Court dismissed an appeal against a denial of Medibank’s claim for privilege (at common law) over three expert reports prepared by Deloitte. The expert reports were procured in response to a 2022 incident in which Medibank’s IT systems were accessed by ‘cyber rogues’ who made ransom demands for the information obtained.
 
Deloitte was engaged by Mallesons on behalf of Medibank. Mallesons’ letter of instruction stated that the engagement was for the purpose of providing confidential legal advice in respect of anticipated class actions and regulatory inquiries and that the resulting reports would be privileged.
 
As the primary judge had done, the Full Court emphasised the objective nature of the dominant purpose test (from Esso Australia Resources Ltd v Commissioner of Taxation (1999) 201 CLR 49), having regard to the totality of the evidence, not just affidavits asserting purpose. Even though Medibank’s chairman, CEO and general counsel testified to the legal purpose of the reports, the Court found, in light of other evidence, such as APRA’s involvement in drafting the terms of reference to the expert and an ASX release from Medibank at the time of commissioning the review that it would, amongst other things, ‘learn from this event’ and would commit to ‘sharing the key outcomes of the review, where appropriate’, that the legal purpose was not predominant and did not prevail over other purposes, including regulatory and governance. 
 
In Mastercard Asia/Pacific (Australia) Pty Ltd v ACCC [2026] FCAFC 37, the ACCC claimed that Mastercard entered into merchant agreements (‘SMAs’) for allegedly uncompetitive purposes, in particular, to deter merchants from acquiring services from Eftpos Payments Australia Ltd by offering to certain merchants beneficial rates in exchange for them routing debit transactions through Mastercard and not Eftpos. Mastercard filed affidavits from two of its senior officers in which they explained the purposes of the SMAs and deposed to internal discussions with other officers including their general counsel in relation to concerns with the strategy, but denied it was for an uncompetitive purpose. One affidavit exhibited an internal paper referring to the SMA arrangement as having ‘reputational risks’ but that it had been approved by internal and external legal advisors.
 
The Full Court upheld the primary judge’s decision that legal professional privilege (at common law) over the legal advice had been impliedly waived, for two principal reasons.
 
Firstly, the voluntary filing of the affidavits (at least in the Federal Court) was inconsistent with the maintenance of privilege, even prior to the affidavits being ‘read’ at trial, because they were intended to be the testimony of the witnesses at trial (and at trial they would be ‘read’ at which point they would become evidence) and they were filed without qualification as to whether certain parts would not be read at trial. The Full Court considered it antithetical to efficient case management to allow Mastercard to withhold relevant documents (based on privilege) until trial when the affidavits would be formally ‘read’ and the privilege waived.
 
Secondly, waiver may occur where the contents of privileged communications are not referred to, but implied assertions are made that relate to those communications, which necessarily lays open the confidential communication to scrutiny (following Grocon Group Holdings Pty Ltd v Infrastructure NSW (No 2) [2023] NSWSC 1144).  So, where legal advice is given about a fact referred to in witness evidence, that may be sufficient to waive legal professional privilege in that advice, in order to enable the testing of that evidence. By way of an example, the Full Court considered that redactions on a response to an internal Mastercard email querying whether it was acceptable to provide a rate in exchange for commercial commitments ought be removed to enable the ACCC and the Court to see if that response was consistent with assertions in the affidavits.
 
These two decisions demonstrate a narrow approach to legal professional privilege. Medibank is particularly relevant for expert reports and encourages the use of ‘single-purpose’ reports, only prepared for legal purposes. Mastercard demonstrates the care required when preparing affidavits to avoid (or at least minimise) any risk of implied waiver of privilege over legal advice on a topic in the affidavit.

Michael Whitten KC and Andrew Downie