Crisis management from a legal lens: The role of lawyers and what you need to know about legal professional privilege

In this session, Melissa and Jeffrey will discuss the practical and legal considerations that organisations need to consider pre-incident, and at every step of the crisis management process following a cyber-attack, with a particular focus on issues around privilege of reports generated by digital forensic experts.

The session will start off with a discussion on what organisations need to have in place pre-incident to ensure readiness for a cyber-attack, being having incident response plans ready, understanding the importance of having cyber insurance, undergoing tabletop exercises, and staff training to ensure directors, boards and employees at all levels to equip them with the knowledge they need.

The session will then focus on the roles of lawyers in crisis management and incident response, and the legal considerations that organisations need to consider in relation to legal professional privilege over communications relating to the forensic investigation and the reports generated by digital forensic experts. The discussion will analyse the Optus and Medibank judgments in which the Courts found that legal professional privilege did not attach to the Deloitte reports themselves, and what this practically means for organisations.