On 2 May 2023, the hotly anticipated Terrorism (Protection of Premises) Bill, known as Martyn’s Law, was published in draft, along with explanatory notes, an impact assessment and a letter from the Rt Hon Tom Tugendhat, Security Minister.
The issue
The issue at which this draft legislation is aimed is the lack of mandatory requirements for those operating premises or events open to the public to consider terrorist threats and apply proportionate protective security preparations. We are not alone in this: Annex 1 to the Impact Assessment shows that, on an international comparison, few jurisdictions provide comparable legislation.
Since 2017, it is suggested that the UK has experienced several terrorist attacks and prevented a further 37 plots. There has been a significant diversification of the threat in the UK in recent years, with low sophistication attacks becoming more prevalent.
Beyond the impact on victims and their families, terrorism causes economic damage and a broad negative impact to the wider economy through fear.
The objective
The strategic objectives are clearly stated: to keep citizens safe and secure; reduce the impact of terrorist attacks where they do occur; provide clarity on responsibility for security activity; and improve consistency in security considerations and outcomes.
The draft Bill
The granular detail of the draft Bill will not come as a surprise to those who have followed the course of the proposed legislation to this point.
In brief, qualifying public premises will be subject to the requirements in the Bill. Section 2 defines them as having a minimum public capacity of 100 people; public access and use falling within Schedule 1. This includes activities such as entertainment, leisure, health care and education. Qualifying premises can also be contained within other premises (for example, stores within a shopping centre). Where this is the case, the Bill will apply to each of those premises as well as the larger premises, if they are each qualifying public premises.
Qualifying public premises are then separated into two tiers. Section 3 sets out that standard duty premises have a capacity of between 100 and 799 people, and enhanced duty premises have a capacity of 800 or more.
Qualifying public events with a capacity of 800 or more are generally subject to the same requirements as enhanced duty premises (see section 4).
Standard duty requirements include simple, low-cost activities which seek to improve protective security and preparedness. This includes:
- undertaking a standard terrorism evaluation at least annually (see section 11), and
- providing relevant workers with appropriate terrorism protection training (see section 13).
Requirements for enhanced duty premises and qualifying public events include:
- an enhanced terrorism risk assessment, that is reviewed with each material change to or use of the premises and at least annually (see section 12)
- terrorism protection training for relevant workers (see section 13);
- reasonably practicable security measures to be put in place (see section 15);
- the appointment of a designated senior officer (see section 16)
- the preparation and maintenance of a security plan (see section 17).
For those premises with a capacity of less than 100 people, that fall outside the proposed legislation, the Impact Assessment notes that the Home Secretary will encourage such premises to adopt voluntary measures to reduce terrorism risks.
Cost and carve outs
The cost of these requirements for a standard duty premises is estimated to be around £2,000. The cost for an enhanced duty premises is estimated to be over £80,000.
In a departure from earlier stages, the accompanying letter recognises that the costs may not be borne equally and therefore imposes a carve out from the requirements for temporary events with a capacity of fewer than 800 people.
It is also worth noting from Schedule 1 that places of worship are to be treated as standard duty premises regardless of greater capacity, unless there is an admission charge. Transport premises already subject to transport security regulations are also excluded from scope.
The regulator and sanctions
The Bill creates a familiar framework of interlocking duties overseen by a regime of regulatory inspections and sanctions for contravening a relevant requirement. Health and safety professionals will recognise much in the proposed approach, which emulates concepts already established in other elements of premises safety, including fire safety, building safety and construction work.
In terms of the regime:
- Qualifying premises and events will need to be registered with the regulator. It is assumed the resulting register can then be used to inform inspection activity.
- Proactive inspections are envisaged – the impact assessment anticipates the regulator inspecting an estimated 5% of premises each year with much of the associated costing extrapolated from HSE data regarding staffing ratios and costs.
- The Bill places key duties on the ‘person responsible’, which can be either an organisation or an individual. The extent of their obligations will depend on whether the premises are standard or enhanced duty or a qualifying event.
- Where there is more than one ‘person responsible’, the Bill requires co-ordination of efforts and sets out specific legal duties to co-operate, both in respect of the objectives of the Bill itself but also in relation to linked fire safety obligations. This extends to the ability of dutyholders to serve co-operation notices on one another in certain circumstances.
- The Bill also creates a ‘designated senior officer’ role, which must be an individual and – where the ‘person responsible’ is a business – this must be fulfilled by a director or senior officer of that organisation. The regulator must be told who this person is.
- Enhanced duty premises and qualifying events must prepare and submit a security plan to the regulator, with the detail still to be prescribed by regulations.
The identity of the regulator remains unknown. Key to its effectiveness will be adequate resourcing, something recognised in the impact assessment published with the Bill. It is possible that a new regulatory body will be set up but equally that the responsibility will be added to an existing authority’s remit. Whatever the conclusion, the Government has been clear that it expects most organisations will want to comply with the legislation and that the primary function of the regulator will therefore be in providing guidance. However, the regulator will also have a variety of enforcement tools to call upon in the event of a contravention:
- Schedule 2 sets out the investigatory powers that the regulator will have. These include the ability to require information and documents to be provided and to enter premises (on occasion without a warrant) for prescribed purposes.
- Civil sanctions have proved popular with regulator and businesses alike in environmental cases. This Bill proposes regulator imposed fixed penalties not exceeding £10,000 for standard duty premises but rising to the higher of £18m or 5% of global revenue for enhanced duty premises and qualifying events. This can be supplemented by a requirement to pay daily penalties for each day on which a contravention continues beyond the period set for payment of the fixed penalty.
- The regulator will have the power to serve restriction and/or contravention notices, with a right of appeal to the Tribunal. This process bears some of the hallmarks of the existing system of enforcement notices under the health and safety law.
- The drafting also provides for criminal offences for failing to comply with a restriction and/or contravention notice, but only in relation to enhanced duty premises and qualifying public events. Importantly, the Bill proposes individual liability for senior individuals where their organisation commits an offence and does so with their consent, connivance or neglect. Upon conviction for the most serious offences, the Bill allows for a maximum sentence of two years imprisonment.
An insurance sector perspective
Insurers, brokers and insureds should consider the impact of the draft Bill on coverage and exclusions in existing property, terrorism, public liability and D&O policies, as well as whether there is a need for additional insurance products to be procured or developed.
The Impact Assessment notes that: “… there could be implications for insurance policies and premiums for premises in scope….”, and that these impacts may have a positive or negative effect on premium, depending on how businesses are able to demonstrate improvements in planning and security, in response to the new requirements.
There will also be a broader impact on insurance products, both in terms of the existing property and terrorism cover, and how other lines of business may be affected. The Bill envisages the promotion of co-operation between different stakeholders, for example, in relation to the organisation of a large event, or between the different entities engaged in the running of a shopping centre. It will be crucial for insurance arrangements to reflect how the responsibility to meet the new obligations is shared between multiple parties. Alongside this, policyholders and brokers should be aware that the necessary increased co-operation and consultation may result in additional information becoming available that should be provided to insurers as part of the presentation of the risk at placement.
An immediate impact of the Bill is likely to be an increase in demand for terrorism insurance, as business owners become more aware of the risks associated with the operation of public premises. Terrorism cover is traditionally a first party cover, either as part of or separate to property insurance.
The more significant impact of the shared obligations and responsibilities relates to liability insurance. While s42 makes it clear that nothing in the Bill “…confers a right of action in any civil proceedings in respect of any contravention or a requirement imposed on any person …”, the increased standards that business owners will be expected to meet may be relevant to determining liability, as part of a broader analysis of the scope of any duty of care. Along with the increased awareness of the need to take proactive measures to protect the public, we would not be surprised to see increased demand for liability cover. If this happens, there are questions about how the market would cope with an increase in demand. There are also potential D&O implications in relation to designated senior officers responsible for enhanced duty premises.
An education sector perspective
All educational establishments will fall within the standard tier, regardless of their capacity, apart from higher education establishments. For under 18s education, existing safeguarding requirements should provide a good starting point for preparing plans, with a number of response arrangements already in place.
In terms of higher education, the requirement to comply with enhanced tier obligations will only apply where capacity is over 800 people. Universities have diverse property portfolios (from rural to city centre campuses) and will have multiple buildings which could each exceed the 800+ trigger. They may also form part of an identified ‘redline’ campus which would require different risk assessments to a stand-alone building.
It is currently unclear what the requirements will be in relation to university residential accommodation and how this sits within a wider campus responsibility. For example, would this need to be factored into a campus response plan even if an individual building plan isn’t needed? Campus security will have a large part to play, but this won’t remove senior university staff from liability at Estates levels and beyond. The governance requirements of creating and implementing the response plan will need to be considered. Universities are also alive to the risk that an attack could come ‘from within’ and part of their response plan could consider how it engages with the potential for a threat from its own residents/users.
An employer’s perspective
The key clauses for employers are sections 13 and 14, which deal with terrorism protection training for relevant workers. A crucial part of compliance is organisational preparedness. In practice, the people measures involved will include introducing training and refresher courses to educate staff on their obligations. The requirement for terrorism training is relevant for both standard duty premises as well as enhanced duty premises and qualifying public events.
The scope of relevant workers is wide. A ‘relevant worker’ is an individual who works at, or in connection with, the premises or event and who has responsibilities that make terrorism protection training appropriate. So this will include employees and non employees and full or part-time workers. The Bill also states that it is irrelevant whether or not the individual is remunerated for their work, albeit all of these factors may be relevant to what training is appropriate.
The Bill gives guidance as to when training must be given and what it must cover (what will be appropriate will depend on a number of factors, including size of premises and nature of event). It is expected that training materials will be available from Government sources to educate relevant personnel on the threat posed by terrorism, and the actions personnel should undertake in response.
Organisations to which the duty applies may need to enhance their in-house security capability and capacity, potentially by creating new positions. Alternatively organisations may need to use external consulting support to assess and mitigate the risks appropriately.
Some employees may be anxious about renewed focus on terrorism threats; supporting mental health issues will include referring to Employee Assistance lines and potentially Occupational Health.
The Bill states that the security plan, to be provided to the regulator, must include details of the terrorism protection training provided. As ever, retaining evidence of compliance will be essential.
A health sector perspective
We previously considered how the proposed duty might impact the health and social care sector.
We now have clarity that use as a hospital or for the provision of health care will be a qualifying activity. The draft Bill is clear that ‘health care’ covers ‘all forms of health care provided to individuals, whether relating to physical or mental health, and including ancillary care’ and hospital is given the meaning in section 275 of the National Health Service Act 2006. Any organisation, whether public sector or otherwise (including charities and not for profits) will need to consider these definitions along with the public capacity of their premises to consider if the duty will apply.
What is unclear at this point is how the duty will be incorporated into existing requirements, including those under the Civil Contingencies Act 2004 and the NHS England Emergency Preparedness, Resilience and Response Framework. The NHS, for example, already prepares for a number of potential threats and hazards, including terrorism, and so should be well-placed to use existing plans and procedures to assist with compliance.
Once enacted, we would expect to see updates to procurement regimes to ensure that those undertaking qualifying activities have complied with the duty.
A charity sector perspective
Charities and not for profits, including social enterprises and community groups, operate a wide range of venues in terms of size and use, often relying on grants and donations. Governing bodies will be keen to track the progress of the draft Bill to understand how it will impact their operations, including potential cost implications in the current economic climate.
For the sector, the proposed legislation will cover uses including as a library, museum or gallery; for recreation, exercise or leisure by visiting members of the public; as a visitor attraction of cultural, historic, touristic or educational value; as a hospital; places of worship.
Organisations will also want to consider any large events they hold and where those events are typically held given the requirements for qualifying public events.
The Government has previously stated that it will “use the scrutiny period to better understand the impact on premises and events run by charitable and voluntary led groups, and in turn consider the proposals and how these groups can be supported.”
A real estate perspective
Key from the perspective of property owners and occupiers is determining the extent to which those that hold and manage real property interests might fall within the scope of the legislation, to ensure they can comply with their duties effectively. The obligations will fall on the person who has control of the premises as ‘occupier or otherwise’.
To this end, the definition of ‘qualifying public premises’ is welcome and it includes a broad range of expected venues to which the legislation will eventually apply including, among others, shops, hotels, food and drink retailers, nightclubs, theatres and cinemas, sports grounds and leisure venues. It excludes private dwellings and offices.
The explanatory notes also clarify that ‘qualifying premises’ can sit within other premises – for example a large retail unit within a shopping centre. There will obviously need to be co-operation between retailers and the centre operators and the Bill anticipates this: “the person responsible for a store within a shopping centre must comply with the operator of the shopping centre as necessary for the operator to fulfil their duties under the Bill”.
The methodology around assessing capacity will also be critical. For example where there are open air qualifying premises the guidance suggests that ‘express permission’ will be required to assess capacity, however, for other types of premises it might be ‘implied’.
The regulations around capacity of premises is to be determined by the Secretary of State and so will presumably follow. The guidance notes accompanying the Bill suggest “such regulations might require some types of premises to determine their capacity differently from others”.
While there is obviously more to come, the Bill provides an excellent opportunity for property owners and occupiers to open a dialogue around compliance and the extent to which this needs to be recognised and managed in owner occupier relationships going forward.
What next?
The draft Bill has been published for pre legislative scrutiny by the Home Affairs Select Committee. This allows for the detailed examination of an early draft before the final version is drawn up by the Government. It also provides the opportunity for parliament and stakeholders to comment on the proposals and for changes to be made in response.
DAC Beachcroft is uniquely placed to provide both overarching commentary and sector specific guidance. To continue the conversation during this scrutiny period, please contact our experts below.
