The Australian reports in Class action against Optus after 2022 data breach registers 160,000 members that about 160,000 members have joined in the class action against Optus resulting from the 2022 data breach. This report is based on submissions made at a case management hearing before Justice Beach today. 

The class action is brought in proceeding PETER JULIAN ROBERTSON & ANOR v SINGTEL OPTUS PTY LIMITED ACN 052 833 208 & ORS (number VID256/2023).

The article provides:

Appearing for class action behemoth Slater & Gordon, barrister William Edwards, KC, told the Federal Court on Wednesday the estimated number of members to join the action, which alleges Optus failed to protect the personal information of 9.8 million of its current and former customers whose personal data was leaked online after a cyber attack.

The court was told Optus and Slater & Gordon were still trying to settle the case by mediation, with a hearing possible if that failed.

In court, the parties argued over how much security Slater & Gordon should give Optus since it insisted on a secretive regime to keep documents exchanged in the case away from the public. Read the rest of this entry »

The Victorian Supreme Court in Re Lifestyle Residences Hobsons Bay Pty Ltd (recs & mgrs apptd) [2023] VSC 179 considered a range of issues; whether a director can bring an application when receivers appointed, the operation of section 109X(1)(a) of the Act and the calculation of service. it makes it clear that there is an immutability of filing an application out of time making the application is a nullity.

FACTS

The facts relating to service were:

• on 22 November 2022, Ms Celia Luki, the solicitor with carriage of the matter for the defendant, ascertained the registered office address of the Company from an Australian Securities and Investments Commission (‘ASIC’) company search [35].
• Luki requested the Office Services Clerk in her firm in Redfern, New South Wales, to organise for the documents to be couriered to Melbourne for delivery to the registered office address.
• a Client Services Assistant at McCullough Robertson received Luki’s instructions on the service of the statutory demand in the sum of $213,166.89 in an email forwarded to her by the Office Services Clerk, who also provided the statutory demand and accompanying affidavit.
• the assistant logged into the Toll Priority (Aus) system and inputted those details, recording Luki’s email address as the contact person to receive email updates on the progress of the delivery of the demand. She printed a label from the Toll system, which included all of the recipient’s details which she affixed the label onto a Toll Express Services priority satchel and obtained a tracking number and manifest document.
• in the afternoon of 22 November 2022, a courier from Toll attended the McCullough Robertson office and collected the sealed envelope and two copies of the manifest document [35]
• on 16 December 2022 the tracking log records the documents were delivered to the company at the registered office address on 23 November 2022 at 9:46am. The proof of delivery document clearly records the registered office at which delivery occurred and the signature of Paula accepting delivery of the envelope [36]. Paula was a receptionist an accounting firm engaged by the company, whose business address is the registered office address of the company.
• Paula was unsure who to forward the demand to and sought confirmation from her principal, Mr Sam Cimino. However, because Cimino was extremely busy that day, she was only able to email him and unable to speak to him in person [37].
• on 24 November 2022, Paula had a discussion with Cimino, who instructed her to immediately send the statutory demand to Mr Burgess, Mr Dale Harrison and Mr Peter Van De Steeg, who are nominated contact people at the company. 
• Paula emailed the nominated people at the company, attaching an electronic copy of the statutory demand but erroneously stated the demand had arrived by courier at the registered office address on 24 November 2022 when, in fact, it was delivered by courier the day prior [38]. 

Read the rest of this entry »

In Re J Build Developments Pty Ltd [2022] VSC 434 Hetyey AsJ set aside a statutory demand on the basis that there was a genuine dispute in the context of a notice being issued under the Building and Construction Industry Security of Payment Act 2002.

FACTS

The facts in applications to set aside statutory demand relating to construction contracts and building works invariably have complicated and involved factual issues.  This case is no exception.

On 26 June 2020, J Build entered into a $2.9 million building contract with Abboud Corporates Pty Ltd to construct three double-storey residential dwellings at 10 Glyndon Road, Camberwell, Victoria (‘the head contract’ and ‘the property’, respectively) [2].

AES is a mechanical and electrical services provider specialising in heating, ventilation, air conditioning and associated electrical work [2].

On or about 24 February 2020, Jamiel Daou (“Daou”),  a director of J Build, texted Wright, the sole director of AES, asking for  a quotation  for the supply and installation of ducted heating and cooling air-conditioning systems in each of the units at the property (‘the sub-contracting works’).  There was a subsquent telephone conversation between the two the contents of which are in contention.

On 5 March 2020, AES provided JB Build with a quotatio of $88,002.64 inclusive of GST.

Prior to 22 October 2020, JB Build requested that revisions be made to the quotation. On 22 October 2020, AES issued a second quotation for $101,507.09 (inclusive of GST) [6].

On or around 27 October 2020, the parties discussed a further variation which would provide a cost saving to the plaintiff of between $5,000 and $6,000 and reduce the contract price contained in the second quotation [7]. On 28 October 2020, Wright emailed Daou requested confirmation of the revised second quotation with Daou responding via email  with the word ‘[a]pproved’ [8].

On 31 October 2021, AES issued an invoice for $16,874.55 (inclusive of GST) regarding work performed between 28 October 2020 and 31 October 2020,  payable by 14 November 2020 but paid on 7 December 2020 [10].

Wright and Daou  had a site meeting at the property on or around 5 February 2021 where they discussed the need for further variations to AES’ scope of work [11]. AES issued J Build with a further revised quotation on 14 May 2021, documenting additional proposed revisions to the scope of work and increasing the contract price to $109,047.31 (inclusive of GST) (‘the third quotation’). A signed acceptance of the third quotation was returned to AES via email later that day [12].  AES rendered an invoice in the sum of $81,504.61 (inclusive of GST) (‘the second invoice’)  to J Build by email on 14 On 31 May 2021. AES required payment by 30 June 2021. J Build didn’t pay by this date and in or around July 2021, AES stopped work [13]. J Build paid AES $41,504.61 on 22 July 2021 and $5,000 on 20 September 2021 [15], leaving $35,000 owing in respect of the second invoice.

On 4 October 2021, AES served a notice under s 18(2) of the Building and Construction Industry Security of Payment Act 2002 (Vic) (‘the SOP Act’) on J Build,   J Build responded the next day by sending AES a payment schedule informing AES that it proposed paying nil in respect of the second invoice on the basis that works had not been completed. No adjudication application was ultimately pursued by AES [16].

On 14 October 2021 AES instructed its solicitors to issue and serve the statutory demand claiming the  $35,000 as ‘monies due and owing pursuant to [AES’] tax invoice no 6394 dated 31 May 2021,’ which refers to the second invoice. The statutory demand did not annex a copy of the second invoice [17].

J Build commenced this application  on 3 November 2021 [18].

The defendant contended that:

• the second invoice referred to in the statutory demand constitutes a ‘payment claim’ within the meaning of s 14 of the SOP Act which was not effectively challenged by way of a ‘payment schedule’ served within time and is therefore due and payable by force of statute and beyond challenge.
• J Build was precluded from contending the existence of any genuine dispute about the subject of the statutory demand in this proceeding.

DECISION

The court, at [21],defined the issues for determination as:

(a) is there a genuine dispute under s 459H(1)(a) of the Act that the defendant’s invoice the subject of the demand (ie the second invoice) is a ‘payment claim’ which satisfies the requirements of s 14 of the SOP Act? In particular, is there a genuine dispute whether: Read the rest of this entry »

Justice John Dixon has provided a very valuable judgment in Agustin-Bunch v Smith (No 2) [2022] VSC 290 providing a very useful and detailed analysis of how to plead, and more particualrly how not to plead defences.  It ended up being a bad day at the office for the defendants.

FACTS

The plaintiffs by writ seeks:

• damages,
• a permanent injunction restraining the defendants from publishing certain material, and
• a mandatory injunction for the removal of certain publications from the internet that they allege are defamatory [1].

The second plaintiff seeks damages pursuant to s 236 of the Australian Consumer Law (‘ACL’), contending that the defendants had engaged in misleading or deceptive conduct in contravention of s 18 of the ACL [1].

On 12 April 2021,  the court refused the plaintiffs’ application for an interlocutory injunction restraining the defendants from publishing or causing to be published in any form, or maintaining online for download, or uploading so as to make available for publication online:

(a) 15 specific videos;
(b) hyperlinks to a Facebook group described by the plaintiffs as the ‘Dr Farrah Hate Page’;
(c) certain Facebook and Instagram posts;
(d) the imputations and representations set out in nominated paragraphs of the plaintiffs’ statement of claim; and
(e) any matter of and concerning the plaintiffs to the same purport or effect as any of the publications referred to.

The relevant publications alleged to convey defamatory imputations are videos [6] where Dr Smith speaks partly in Tagalog and partly in English to a Filipino audience [7].

The defendants pleaded the defences of:

• truth,
• contextual truth,
• honest opinion, and
• qualified privilege both at common law and relying on the relevant statutory provisions [8]

The plaintiffs allege about 70 imputations and the defendants plead a truth defence to approximately 60 imputations [10].The defences have been Read the rest of this entry »

The Federal Court, per Rares J, found for John Barilaro in Barilaro v Google LLC [2022] FCA 650 for defamation by means of posts on YouTube and awarded him $715,000.

FACTS

The publications complained of were two YouTube videos prepared by a Mr Shanks:

• bruz, first uploaded on 14 September 2020.  The contents are described in great detail at [33] – [63]; and
• Secret Dictatorship, first uploaded on 21 October 2020 [3].  It is described in great detail at [81] – [91]

The imputations pleaded in bruz video was that:

(a) Mr Barilaro is a corrupt conman;

(b) Mr Barilaro committed perjury nine times;

(c) Mr Barilaro has so conducted himself in committing perjury nine times that he should be gaoled;

(d) Mr Barilaro corruptly gave $3.3 million to a beef company; and

(e) Mr Barilaro corruptly voted against a Royal Commission into water theft [4].

The imputations pleaded in Secret Dictatorship video was that:

(a) Mr Barilaro has acted corruptly by engaging in the blackmailing of councillors;

(b) Mr Barilaro has acted corruptly by engaging in the blackmailing of councillors using taxpayer money; and

(c) Mr Barilaro has pocketed millions of dollars which have been stolen from the Narrandera Shire Council [5].

On 25 November 2020 Barilaro’s chief of staff, McCormack, contacted Google Australia’s manager to complain about the racist and untrue content of friendlyjordies videos [129].  On 30 November 2020 Barilaro’s social media manager made a formal complaint to YouTube about the allegations Read the rest of this entry »

In Re Australian Builders Group Pty Ltd [2022] VSC 254 the Supreme Court, per Hetyey AsJ, set aside a statutory demand based on a genuine dispute based on the construction of an agreement and default notice but also by a claim of duress.

FACTS

On or around 1 June 2017 Mind, a not-for-profit organisation providing community-managed specialist mental health services entered into an agreement with Australian Win Win Investment Pty Ltd (‘the landlord’) to lease a property located at 691 High Street, Thornbury, Victoria (‘the property’ and ‘the lease’ respectively) for an amount of $130,000 per annum (approximately $10,833.33 per calendar month) [1].

In early May 2018, Mind and ABG entered into a sublease agreement for the property (‘the sublease’). The parties to the sublease agreed that ABG would pay a reduced amount of rent of $121,000 per annum (approximately $10,083.33 per calendar month) [2].

From February 2019, ABG began to fall into arrears & by 15 April 2021, it owed Mind approximately eight months’ rent, totalling $82,279.92 (‘the arrears’). Pursuant to a repayment deed, ABG agreed to make regular payments of the arrears of $2,500 plus GST, together with interest, per week.

Regarding the repayment Read the rest of this entry »

In A & J Morphett Nominees Pty Ltd v JBT Lawyers Pty Ltd & Anor [2022] VSC 238 Justice Dixon in upholding an appeal made important statements for practitioners on the role of stakeholders.

FACTS

On 26 November 2018 the appellant and Chloe Estelle Pty Ltd entered into the contract with the appellant paying the deposit of $42,000 to the respondent on 6 December 2018 [4].

On 21 March 2019, the appellant by written notice terminated the contract and requested that the respondent repay the deposit to it [4].

The appellant, A & J Morphett Nominees Pty Ltd, commenced proceedings against Chloe Estelle Pty Ltd, as first defendant, and the respondent, JBT Lawyers Pty Ltd, as second defendant in the Magistrates Court.  In its defence the respondent admitted that it received the deposit sum as a stakeholder as alleged by the appellant [6].

On 24 June 2019, the appellant entered default judgment in the proceeding against Chloe Estelle Pty Ltd, which included an amount for interest and costs [7]. The appellant did not recover against Chloe Estelle Pty Ltd as it was and on 18 July 2019, an administrator was appointed and it was subsequently ordered to be wound up. The liquidators made no claim for the deposit.

It was never been in dispute that the respondent received that sum as a stakeholder for the appellant and Chloe Estelle Pty Ltd [3].

On 29 March 2019, the Federal Circuit Court, per Small J,made an order in a Family Law dispute between different parties.  It relevantly Read the rest of this entry »

The Federal Court, per Halley J, set aside a statutory demand in CBS Commercial Canberra Pty Ltd v Axis Commercial (ACT) Pty Ltd, in the matter of CBS Commercial Canberra Pty Ltd [2022] FCA 544 in finding that an offsetting claim constitutes a genuine dispute. It is a very good decision setting out the complications of offsetting claims arising from building contracts relied upon in setting aside a statutory demand which is based on a certificate and judgment obtained under the Security of Payments Act.

FACTS

CBS engaged Axis as a sub-contractor to undertake work at a building site located in Gungahlin in the Australian Capital Territory [12].

The chronological events Read the rest of this entry »

The Federal Court, per Rolfe J, in Australian Securities and Investments Commission v RI Advice Group Pty Ltd [2022] FCA 496 made what has widely been described as a first occasion a corporation has been found to have breached its licence obligations in failing to have adequate risk management systems to manage its cyber security risks. The Court ordered declaratory relief requiring RI Advice to undertake work to improve its security under the supervision of an expert.  

The orders were made in terms agreed between the parties just before the trial was scheduled to commence.

I have followed this proceeding closely with posts ASIC commences action against RI Advice Group Pty Ltd for failing to have adequate cyber security in August 2020 and ASIC v RI Advice Group Pty Ltd cyber security civil penalty trial pushed off from a 29 November 2021 hearing date to a date in April 2022 in May 2021,

FACTS

The Court provided a factual background about stating that RI Advice :

• was:
  • a wholly-owned subsidiary of Australia and New Zealand Banking Group Limited (ANZ). RI Advice up to and including September 2018;
  • from 1 October 2018, along with two other ANZ financial licensees, part of the IOOF Holdings Limited (IOOF) group of companies [12]
• carries on a financial services business within the meaning of s 761A of the Corporations Act Act (“The Act”) under a third-party business owner model.
• authorises Under s 916A of the Act, RI Advice independently-owned corporate authorised representatives (“ARs”) and individual authorised representatives to provide financial services to retail clients on RI Advice’s behalf and pursuant to the Licence [13]

The AR Practices (practices of groups of one or more Authorised Representatives):

• electronically received, stored and accessed  confidential and sensitive personal information and documents in relation to their retail clients. The personal information included:

(a) personal details, including full names, addresses and dates of birth and in some instances health information;(b) contact information, including contact phone numbers and email addresses; and

(c) copies of documents such as driver’s licences, passports and other financial information [14].

• since 15 May 2018 provided financial services to at least 60,000 retail clients [15]
• had 9 cybersecurity incidents between June 2014 and May 2020, being:
  • in June 2014 an AR’s email account was hacked and five clients received a fraudulent email urging the transfer of funds, one of whommade transfers totalling some $50,000;
  • in June 2015 a third-party website provider engaged by an AR Practice was hacked, resulting in a fake home page being placed on the AR Practice’s website;
  • in September 2016 one client received a fraudulent email purporting to be an employee of an AR Practice asked for money. The AR Practice used an email platform where information was stored “in the Cloud”, with was no anti-virus software and only one password which everyone used.
  • in January 2017 an AR Practice’s main reception computer was subject to ransomware delivered by email, making certain files inaccessible;
  • in May 2017 an AR Practice’s server was hacked by brute force through a remote access port, resulting in file containing the personal information of some 220 clients being held for ransom and ultimately not recoverable;
  • between December 2017 and April 2018 (December 2017 Incident) an unknown malicious agent gained unauthorised access to an AR Practice’s server for several months  compromising the personal information of several thousand clients, some of whom reported unauthorised use of the personal information;
  • in May 2018 an unknown person gained unauthorised access to the email address of an AR and sent a fraudulent email to the AR’s bookkeeper requesting a bank transfer;
  • an unauthorised person used an AR Practice’s employee’s email address:
    • in August 2019 to send phishing emails to over 150 clients ; and
    • in April 2020 to send phishing emails to the AR Practice’s contacts [16].

Inquiries and reports following the cybersecurity incidents revealed thatthere were a variety of issues in the respective ARs’ management of cybersecurity risk, including:

• computer systems not having up-to-date antivirus software installed and operating;
• no filtering or quarantining of emails;
• no backup systems in place, or backups not being performed; and
• poor password practices including:
  • sharing of passwords between employees,
  • use of default passwords,
  • passwords and other security details being held in easily accessible places or being known by third parties [17].

Regarding the incidents Read the rest of this entry »

The Full Bench of the High Court heard argument in Google LLC v Defteros [2022].  It is a case of considerable interest to defamation practitioners.  The key issue is whether a search engine a publisher of defamatory material on a third party website to which that search engine provides a hyperlink when the search result on its own conveys no defamatory imputation.  Also Google seeks a ruling on what is required to notify the search engine of defamatory publication for the purposes of the common law doctrine of innocent dissemination and the statutory defence under section 32 of the Defamation Act 2005. 

The transcript of oral argument before their Honours can be found here.

It is an appeal from a decision from the Victorian Court of Appeal in Defteros v Google LLC [2021] VSCA 167 (17 June 2021).  Interestingly on that occasion the appellant, Defteros, was unsuccessful.  Google’;s cross application for leave to appeal was refused. 

Special leave was granted on 10 December 2021 conditional upon Google paying Defteros’s costs of the appeal and not disturbing the costs orders in the Court of Appeal and at trial.  The transcript of the Special Leave Application can be found here.  In short, there is a public interest in resolving the issue. 

The essence of Google’s submissions is that the trial judge and the Victorian Court of Appeal erroneously found that the provision of a hyperlink was participation in the communication of defamatory material for the purpose of publication.  

The submissions of both parties can be found Read the rest of this entry »