Goodbye job applications, hello dream career
Seize control of your career and design the future you deserve with LW career

Medibank dragging feet on documents relating to data hack

A Federal Court judge questioned why it has taken Medibank so long to disclose documents to applicants who alleged the insurance giant failed to take proper precautions to prevent a major data hack.

user iconNaomi Neilson 01 September 2023 Big Law
expand image

Counsel for the applicant, led by Baker McKenzie, said Medibank has not yet disclosed documents relating to the data breach since they were given the request in mid-February, the Federal Court heard during Thursday’s (31 August) case management hearing.

From the bench, Medibank’s counsel submitted it was not a “small set of documents” the applicants were seeking, which includes audit reports over a five-year period and data from the incident register.

He added that some parts of the requested material “will be a large volume of irrelevant and privileged material”.

Advertisement
Advertisement

The counsel said he was prepared to write to the applicants with a list of what Medibank determined are the “core documents”.

However, counsel for the applicants, Wendy Harris, said since the request has been with Medibank, “we have not been blessed with a letter, let alone an affidavit” explaining the documents.

“It’s unsatisfactory in the extreme for Your Honour to be acting from evidence from the bar table about what is and isn’t possible,” she said.

Justice Jonathan Beach told Medibank he would have “assumed you would have already fathered this material at least six months ago”, and questioned why the financial institution had not at least sent the documents on for the applicants to determine what was appropriate.

“You have had done that a long time ago,” Justice Beach said.

“You have been put on notice for a while.”

Referring to the counsel’s submissions that it would be impossible for Medibank to snapshot specific dates in its incident register, Justice Beach requested they submit an affidavit with proof of this.

During the same case management hearing, counsel on behalf of the Office of the Australian Information Commissioner (OAIC) – which has its own investigation into Medibank – has hit back at the attempt to have them join the proceedings, explaining the commissioner “is not a protagonist in this proceeding and ought not be there”.

It was determined proceedings relating to the OAIC should run separately from the class action proceedings.

“It does seem to be that there should be a separate proceeding,” Justice Beach agreed on Thursday.

You need to be a member to post comments. Become a member for free today!