Protect Duty - The Terrorism (Protection of Premises) Bill edges closer to law

The Bill

In May 2021, the UK government launched a public consultation as to how legislation could be used to enhance the protection and safety of public spaces. The consultation came in the wake of a string of terrorist attacks across the UK.

In December 2022, the government announced further details of the proposed mandatory regime, including the types of premises and activities that would fall within scope of the legislation. Fieldfisher's previous commentary on the proposed Protect Duty legislation and consultation can be found here.

In May 2023, the Draft Terrorism (Protection of Premises) Bill was laid before Parliament and introduced by Security Minister, Tom Tugendhat, who noted that it has become "increasingly challenging to predict threat at specific locations" and that the government should "seek to improve protective security and organisational preparedness at a wide range of public premises across the UK."

The Bill will impose obligations on those responsible for certain premises and events to consider the threat from terrorism and implement reasonably practical and proportionate measures to mitigate the risk. The Bill also establishes an associated inspection and enforcement regime, which will seek to educate, advise and ensure compliance with the requirements of the Bill.

Premises or events which will be subject to the new duties

The requirements within the Bill will only apply to "qualifying premises". Qualifying premises are premises above a stated capacity level and used for a specific purpose, as detailed in Schedule 1 to the Bill. Schedule 1 is a comprehensive list, and includes retail and shopping malls, gyms, sports grounds, visitor attractions and places of worship. Conservative estimates suggest over quarter of a million businesses could become subject to the new duties.

Premises will be categorised into two tiers:

• Venues or premises with a capacity between 100 and 799 will be designated 'standard duty premises'; and
• Venues exceeding a capacity of 800 persons will be 'enhanced duty premises'.

The definition of "capacity" has not yet been provided. The draft Bill states that the 'public capacity' of premises is to be determined in accordance with associated regulations. Until we have further details, venues are likely to rely on their stated capacity levels to determine which category of premises are applicable.

The standard duty requirements are designed to ensure there is a baseline level of protection and preparedness across the UK.

The enhanced duty requirements are more extensive, on the basis that those premises have a responsibility to protect the safety of a much larger number of people.

In addition to a duty placed on qualifying public premises, the Bill creates an enhanced duty where a "qualifying public event" is being held. A "qualifying public event" is a large-scale event, with a capacity of over 800, at premises not otherwise caught by the legislation as qualifying public premises. An example of this could be a village fête, held on village green land, where over 800 members of the public are present at any one time. This provision places an obligation on the person who has control of the premises in connection with the event to comply with the same enhanced duty standards.

Persons responsible

For the purposes of the Bill, the "person responsible" will be the person who has control of the qualifying public premises in connection with their relevant use (as defined in Schedule 1).

In relation to qualifying public events, the "person responsible" is the person who has control of the premises at which the event is to be held, in connect with their use for the event.

We anticipate this definition will apply to a wide range of individuals, including owners of venues, operators of businesses within venues, and events hosting companies. By way of example, a person responsible for a large gym could potentially be either (i) the owner of the gym business, (ii) the manager of the gym premises, (iii) the landlord for the commercial premises which contain the unit sublet to the gym business.

As many events will be jointly controlled, businesses will need to consider carefully any permissions given to third parties or agents who are tasked with hosting an event.

Registration and Notifications

The person responsible for qualifying public premises must apply to the regulator for registration. At present, the Bill does not define who the regulator may be. The Bill makes provision for some qualifying premises to be treated as standard duty premises when they would otherwise be enhanced duty premises, and vice versa which will be at the discretion of the regulator although the application of this discretion will need to be detailed in further guidance.

In the case of qualifying public events, the person responsible must ensure the regulator is notified of the event before, or as soon as possible after, details of the event are first made available to the public, and before the event takes place.  

Standard versus Enhanced obligations for responsible persons

The main obligation falling on persons responsible for qualifying public premises is the creation of "terrorism evaluations", which have otherwise been referred to publicly as 'preparedness plans.' These documents are akin to a risk assessment, and analyse the types of terrorist threat the public premises or public event may face, what measures are in place to reduce the risks, and the protocol and procedures to be followed in the event of terrorist activity. The overarching principle behind this is to ensure the persons responsible for the premises or event (as the case may be) has considered how prepared they are in the event terrorist activity takes place in the premises, or at a nearby location.

The obligations for standard duty venues are intended to be less onerous and involve lower costs. Standard terrorism evaluations must in particular assess:

• the type of terrorist activity likely to occur at or near the qualifying public premises (if such acts were to occur);
• the measures in place at the premises, which could be expected to reduce the risk of terrorist activity;
• the measures in place at the premises, which could be expected to reduce the risk of physical harm to individuals, if such acts of terrorism were to occur;
• procedures to follow in the event of an act of terrorism; and
• how people who use the premises (either as visitors or workers) will be made aware of the assessment and any procedures in play.

Enhanced terrorism evaluations will apply to enhanced duty premises and to any qualifying public event, and must include all the criteria for a standard terrorism evaluation, but additionally must consider:

• the size and characteristics of the enhanced duty premises, or the premises where a qualifying public event may be held;
• the nature of the event;
• the current use of the premises in question; and
• the existing measures in place for the premises or event (as the case may be).

In addition, those subject to an enhanced duty will have a positive obligation, as much as is reasonably practicable, to implement measures that might be expected to reduce the risk of acts of terrorism taking place in or near the premises, and to reduce the risk of physical harm that could be caused as a result of such acts. These measures must in particular include:

• measures in relation to monitoring of the premises or event;
• measures in relation to the movement of individuals into and out of the premises;
• procedures to be followed if acts of terrorism were to occur; and
• measures in relation to security of sensitive information.

The draft Bill defines "sensitive information" as information which might reasonably be considered helpful in the planning, preparation or execution of acts of terrorism at, or in the vicinity of, the premises or event.

The draft Bill also gives some guidance on the practical steps that must be taken in the event an attack does occur, including procedures for alerting the emergency services, procedures for alerting persons at, or in the vicinity of, the premises or event; and procedures for evacuation and securing the premises or event.

Terrorism prevention training

The Bill creates an obligation on the person responsible for qualifying public premises or qualifying public events to ensure that terrorism protection training in relation to the premises or event is provided to each "relevant worker".

A "relevant worker" is a person who 'works at, or in connection with' the premises or event, and who has responsibilities that make it appropriate form them to receive such training. Importantly, a relevant worker does not have to be an employee, or receive any form of remuneration for their work. As such, the definition will capture volunteers and other persons associated with the premises or event.

The Bill does not prescribe the type of training required, but any training designed and delivered must be appropriate to:

• the size and characteristics of the qualifying public premises or the qualifying public event (as the case may be);
• the use of the premises;
• the nature of events held; and
• the role and responsibilities of the employee being trained.

Offences and penalties created under the Bill

The Bill includes a package of stringent enforcement measures, including a range of civil sanctions to address non-compliance and criminal offences for the most serious breaches.

Contravention and Restriction Notices

The regulator will have a power to issue contravention notices for failure to comply with relevant requirements, or, in more serious cases, restriction notices, which will restrict the nature of events and activities taking place at the enhanced duty premises only for a period of up to six months.

Failure to comply with either nature of notice where an enhanced duty obligation exists will be a criminal offence, although it will be a defence to show that all reasonable steps were taken to comply with the notice.

Monetary penalties

The regulator will have a power to levy fines against persons responsible for venues, if the regulator is of the opinion that they are falling short of their duty. In addition to the fixed penalty fine, the regulator may also levy a cumulative daily penalty not exceeding £500 for standard duty premises, or, in the case of enhanced duty premises or qualifying public events, a maximum of 1% of the value of the initial fixed penalty. However, the total amount of the daily penalty must not exceed the amount of any fixed penalty.

The Bill gives some detail on how the amount of penalty should be determined, stating that the regulator must take into account the effects of the contravention any action taken by the person to remedy the contravention or mitigate its effects, and any statement issued by the Secretary of State.

There is provision for maximum amounts of fixed penalty, imposed on a person by a penalty notice. If the fixed penalty relates to standard duty penalties, the fine is capped at £10,000. If the fine relates to enhanced duty premises or qualifying public events, the maximum fine is the greater of £18 million and 5% of the person's qualifying worldwide revenue. The Secretary of State will issue regulations on how "worldwide revenue" will be determined.

It is an offence under the Bill if a person fails to comply with a contravention notice relating to enhanced duty premises or a qualifying public event. In addition, a person who fails to comply with a restriction notice also commits an offence. However, it is a defence for a person to show that they took all reasonable steps to comply with the relevant notice.

The Bill creates an additional offence for directors, managers or other similar officers of the corporate body. For example, where the offence has been committed by the body corporate with the consent or connivance of a director, manager or officer, etc., or is attributable to any neglect on the part of that person, they will be guilty of that offence.

What considerations does your business need to take into account?

In advance of further regulations and guidelines on the Bill, we would recommend:

• Assessing your business operations to ensure you understand whether your venue would be a qualifying public premises or a qualifying public event;
• Considering your capacity and whether you fall within scope of the 'standard duty' tier or 'enhanced duty' tier;
• Considering who the 'person responsible' would be for the purposes of the new law;
• Ensuring you have robust risk assessment procedures in place, in readiness to carry out more tailored terrorism risk assessments;
• Considering budgeting for any additional 'reasonable measures' that might be expected to reduce the risk of terror attacks taking place;
• Budget for and plan to carry out full terrorism protection training.

Pending the additional regulations and guidance, we anticipate businesses will wish to consult on any additional, tailored approaches they can take to their security and risk reduction strategies. In our view, this would be prudent given that the Bill now moves into the later stages of Parliamentary scrutiny.

As implementation approaches, we expect the UK government to publish comprehensive guidance for venue owners and operators. Fieldfisher will continue to monitor the Bill's progression and our Health and Safety Team is on-hand to provide advice in the lead up to, and following, the new law coming into force.

With thanks to Kieran Tomlinson, co-author of this article.