On 12 September, the Terrorism (Protection of Premises) Bill 2024 was introduced in Parliament. The Bill, also known as ‘Martyn’s Law’ in tribute of Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack, aims to improve protective security and organisational preparedness for terrorist attacks at public venues across the UK.

This comes at a time when the Government considers the threat level from terrorism in the UK to be “substantial” as well as “less predictable and harder to detect and investigate”.

Pursuant to the draft legislation, those responsible for certain premises and events would be legally obliged to consider the risk and take reasonably practicable measures to mitigate the impact of a terrorist attack.

Background

The Bill’s provisions were developed following engagement with the Martyn’s Law campaign team, expert security partners, businesses, and local authorities, as well as via learnings from the Manchester Arena Inquiry (a statutory public inquiry to investigate the deaths of the victims of the 2017 Manchester Arena attack) and the London Bridge Inquest (an inquest into the 2017 terror attack at London Bridge and Borough Market) which both recommended the introduction of legislation to protect the public and clarify the duties of venue owners regarding protective security.

The Bill also forms part of the Government’s broader counter-terrorism strategy (CONTEST) 2023. At a time when the nature and threat of a terrorist attack is complex and unpredictable, the Government believes now is the time to enhance the UK’s readiness and protection by ensuring a wide a range of premises and events are legally obliged to be better equipped and ready to respond to a terrorist attack.

The Legislation’s Key Provisions

Those responsible for certain premises or events will be required to implement reasonably practicable public protection procedures and/or measures, depending on the capacity of the premises or event.

Tiered Approach

The Bill would establish a tiered approach, linked to the number of individuals reasonably expected to be present on the premises at the same time. Smaller premises (200-799 individuals) would fall within the standard tier and therefore be required to put in place simple procedures to reduce the risk of physical harm to individuals who may be present. Larger premises and events (800 individuals plus) would fall within the enhanced tier with additional procedural requirements in recognition of the potentially higher impact of a successful terrorist attack.

Types of Premises & Events

Premises would include a building, including part of a building or a group of buildings or a building and other land - for example, a hotel plus its grounds where the same are used for dining or events.

The premises would be required to be wholly or mainly used for one or more specified use(s) including shops, bars, pubs, restaurants, hotels, healthcare, education, entertainment such as nightclubs, theatres and cinemas, halls, leisure, sports grounds, libraries, museums, galleries, and places of worship.

Events reasonably expected to have 800-plus individuals in attendance at the same time would also be captured and subject to enhanced tier requirements so long as the event was publicly accessible and met the “express permission” criteria (employees or individuals checking conditions of entry to the event are satisfied by attendees).

Standard v Enhanced Tier Requirements

Persons responsible for standard tier premises (or “standard duty premises”) would be required to put in place appropriate and reasonably practicable public protection procedures to be followed by staff in the event of a terrorist attack at the premises or in the immediate vicinity, including ensuring there are procedures in place to (i) provide information to individuals on the premises and (ii) evacuate, invacuate or lockdown the premises. For these smaller venues there would be no expectation to incur costly or put in place physical measures.

Enhanced tier premises (or “enhanced duty premises”) would also be required to comply with the requirements above, but appropriate and reasonably practicable public protection procedures would need to be documented and provided to the regulator (see below) and would include procedures that could be expected to reduce the vulnerability of the premises or event to an act of terrorism. This might include the monitoring of premises and their immediate vicinity, controlling the movement of individuals into, out of and within the premises or event and physical safety and security. It also would include measures relating to the security of information which may reveal vulnerabilities and assist in the planning, preparation, or execution of acts of terrorism particularly what is appropriate to share, where and with whom.

The requirement for procedures to be “reasonably practicable” would allow those responsible persons to factor in the nature of the qualifying premises or event, ensuring a tailored approach whilst complying with the requirements of the draft legislation.

Who Is the ‘Responsible Person’?

The responsible person would be required to ensure the Bill’s legislative requirements were met.

For a qualifying premises, the responsible person would be the person who has control of the premises in connection with its use. Where premises are let, this would therefore typically be the tenant. However, if qualifying premises form part of other qualifying premises, for example a department store within a shopping centre, then both the tenant and the property owner would each be responsible persons. In this case, the property owner and tenant would be required, so far as is reasonably practicable, to coordinate to ensure individual and cumulative compliance.

For a qualifying event, the responsible person would be the person who has control of the premises at which the event is taking place in connection with its use for that event. For example, if a hotel hosted a public event in its grounds and maintained control of the premises for the purposes of that event, the hotel would be the responsible person irrespective of the involvement of any contracting organisations. Responsibility cannot be delegated to contracted services.

For enhanced tier premises or an event, the responsible person would be required to appoint a designated senior individual (DSI), i.e., someone with high-level management responsibility such as a director or partner, with responsibility for ensuring that the relevant requirements were met.

The responsible person would also be required to notify the regulator when they became and ceased to be responsible for the premises (regulations would set out further details of timings and exactly what information would be required to be provided).

Where the responsible person is the tenant, the requirement to comply with this draft legislation would come within what should be a standard tenant obligation in most market standard leases to comply with all laws relating to the premises and the occupation and use of the same by the tenant. Where the responsible person is the landlord, for example with a shopping centre, then a landlord would likely be obliged to meet its obligations via the provision of services.

Co-Operation

There would be a requirement for persons with control over enhanced tier premises or events but not being the responsible person (for example, the freeholder where premises are let) to co-operate so far as reasonably practicable with the responsible person to ensure the responsible person’s compliance with the proposed legislative requirements.

The Government gives two examples in its additional guidance where a freeholder as landlord would be obliged to consider the above to a reasonably practicable level. The first is when receiving requests from the responsible person to carry out alterations pursuant to the terms of its lease to meet their legal obligations. Where tenant alterations require landlord consent not to be unreasonably withheld or delayed, this would simply be part of the landlord’s decision-making process. The second example is where the responsible person has identified certain mitigations to be implemented to meet their legal obligations, such measures requiring freeholder permission but also the lease states the landlord should contribute a certain percentage of costs to ensure premises remain fit for purpose. The freeholder would be obliged to consider such requests to a reasonably practicable level.

Enforcement & Sanctions

To support enforcement of the regime, the regulator function is intended to be delivered as a new function of the Security Industry Authority (SIA).

The SIA would have inspection and information-gathering powers and would be able to issue a range of civil sanctions including compliance notices and restriction notices for non-compliance resulting in the temporary closure of enhanced tier premises or prohibiting an event from taking place.

The SIA would also be able to issue monetary penalties up to a maximum of £10,000 for standard tier premises and £18 million or 5% of worldwide revenue for enhanced tier premises or events. Daily penalties (up to £500 per day for standard tier premises and £50,000 per day for enhanced tier premises or events) could also be imposed where non-compliance continued.

It would be a criminal offence to fail to comply with an information, compliance, or restriction notice, provide false or misleading information or obstruct the SIA. Further, the offender might be liable to imprisonment and/or a fine.

For enhanced tier premises, senior officers (including the DSI) would potentially be liable to prosecution if the responsible person committed an offence, and it was proven that the offence was committed with their consent or connivance.

Next Steps

The Bill will be considered at a Second Reading on 14 October 2024.

If the Bill were implemented, there likely would be at least two years following Royal Assent to allow for SIA set-up and to ensure sufficient time for those responsible for qualifying premises and events to understand their new obligations, and to plan and prepare to ensure compliance with the legislative changes.

Conclusion

The Bill delivers on the Government’s manifesto commitment to ‘bring in Martyn’s Law to strengthen the security of public events and venues’ ensuring they are better prepared and ready to respond to terrorist attacks.

Whilst many owners and occupiers of premises will already have proactively considered the risk posed by acts of terrorism and have plans and procedures in place, this draft legislation would mandate for the first time who exactly is responsible for considering the risk and taking appropriately proportionate protection measures, applying a consistent level of security standards apply across qualifying events and premises. Property owners and occupiers alike should follow the Bill’s progress.