Hacked? Don't expect legal professional privilege to stop others using your documents, says High Court

Legal professional privilege won't stop documents taken as part of the Paradise Papers hack being used by the Australian Taxation Office in assessing tax liability, in a decision that both affirms traditional views of legal professional privilege, and leaves three key issues undecided:

• what, if any, legal remedy exists for someone whose privileged documents are hacked and then used against them by a government decision-maker;
• the admissibility of hacked documents in subsequent court cases; and
• limited use disclosure of privileged documents to government regulators.

(Glencore International AG v Commissioner of Taxation [2019] HCA 26).

Legal professional privilege a shield, not a sword

The High Court did not need to consider the particular statutory framework of the tax legislation, in finding that Glencore's case disclosed no cause of action.

While it affirmed that the public interest that supports LPP is paramount to "more general public interests" and that LPP, once found, is absolute, it confirmed the received wisdom: legal professional privilege is a shield, and not a sword. Where it applies it is a complete immunity from compulsory production of documents and information, but it does not provide a positive right to claim a remedy (for example, you cannot get an injunction to restrain the use of privileged documents and information).

There thus has been no change to the underlying law of legal professional privilege, and this case does not change or limit a client's right to claim legal professional privilege.

Is there another remedy for protecting hacked information?

Traditionally, threatened or actual misuse of LPP documents would be actionable in equity for breach of confidence. Glencore could not rely on this, however, as this cause of action requires some wrongdoing (or complicity in the wrongdoing of a third party) – and there were no allegations of wrongdoing made against the Commissioner or his officers in obtaining the documents. Furthermore, it was acknowledged that the fact of the Paradise Papers being in the public domain caused a significant difficulty for successfully arguing breach of confidence.

The case therefore leaves open for another day the question of whether a different outcome would be reached on a claim based on breach of confidence, either because there was wrongdoing by the party seeking to use the documents, or because the hacked or stolen documents are not made publicly available.

Are hacked documents admissible in Court?

The High Court recognised there could be undesirable inconsistency in having a government authority make decisions while disregarding publicly available documents, but it did not address the separate question of what happens if that decision is challenged in Court and the government authority wants to rely on those hacked documents.

In a tax context, this could mean that, while the Commissioner can use hacked documents in assessing a taxpayer's tax and issuing a notice of assessment, he might not be able to introduce them into evidence if the taxpayer commenced judicial proceedings to challenge the assessment, as documents subject to LPP cannot generally be admitted, and the Court has a separate discretion to exclude improperly obtained evidence. This may be equally true for judicial proceedings following decisions of the other major regulators and government decision-makers. The question of admissibility may be further complicated by the possibility in future cases that hacked documents may show some wrongdoing sufficient to trigger the fraud or illegality exception to legal professional privilege.

Protecting your documents subject to legal professional privilege post-Glencore

The High Court has not weakened the underlying principles of legal professional privilege in any way and made some strong comments affirming the paramount public interest in legal professional privilege and that LPP, when found is absolute. Clients' entitlement to claim LPP has not been weakened or qualified in any way.

But because of these unresolved issues, you should:

• seek independent advice on the availability of legal professional privilege and the process for claiming privilege when dealing with the regulators;
• stop the common but risky practice of limited use disclosure of LPP documents to government regulators, to allow for careful reflection on whether this decision tips the balance against doing so; and
• ensure that all Terms of Inspection, which are commonly prepared to facilitate LPP claim processes in the context of a statutory notice, expressly exclude the possibility of housing any documents or data with the Commissioner or under his control, example, with his legal advisers, to allow for careful reflection on the decision and how the decision is being understood by the ATO and the other regulators.