Martyn’s Law - The New Bill

October 10, 2024

Gary Grant of Francis Taylor Building summarises the main provisions in the new Terrorism (Protection of Premises) Bill 2024 (“ Martyn’s Law”) and explores what premises and events will be in scope, details of the two-tiered protect duty that will impact 180,000 premises, including many in the hospitality sector and buildings owned by local authorities, and the enforcement provisions, as well as consideration of the reforms to licence plans and interaction with licensing laws.

Introduction and overview

Sometimes, what we do can be a matter of life and death. There are individuals and entities actively seeking to harm us in an effort to further their aims. Ideology, intolerance and hate is their fuel and justification. Since the start of 2017, police and security agencies in the UK have disrupted 39 late-stage terrorist plots and there have been 15 domestic terror attacks. These included the 2017 Manchester Arena bombing where 22 victims lost their lives to a suicide bomber targeting the young attendees of a pop concert by Ariana Grande. Separate to the loss of human life and limb, the cost of terrorism in the UK from 2004–2016 has been assessed at £43.7 billion.^[1] The terrorist threat we currently face is multifaceted, diverse, and continually evolving. At the time of writing, the UK’s terrorism threat level is “Substantial”, meaning a terrorist attack is considered “likely”. Until now, the UK’s approach to protective security at public venues has been entirely voluntary. However, independent research conducted in 2019 showed that, without legal compulsion, counter terrorism security efforts are often deprioritised behind other legally required activities (e.g. fire safety). This results in inconsistent consideration and application of security processes and measures.

In June 2021, Sir John Saunders as Chairman of the Manchester Arena Inquiry, published Volume One of his Report which criticised “the lack of a duty to identify and mitigate the risk of terrorism … to provide adequate protection to the public”. Among his recommendations, Sir John called for legislation to be introduced to improve the safety and security of public venues. This followed on from the Prevention of Future Deaths Report from the London Bridge and Borough Market Inquests, which also recommended the introduction of legislation to clearly set out the duties of owners and public authorities regarding protective security and a 2017 Intelligence and Security Committee recommendation to do the same as part of a report considering the five attacks in 2017.

Too many Inquiry reports end up gathering dust on Whitehall shelves with little to no action on the ground. However, thanks to the remarkable and tireless work of Figen Murray, the mother of Martyn Hett one of the victims of the Manchester Arena bombing, aspirations and recommendations are now being turned into reality.

The introduction of the Terrorism (Protection of Premises) Bill 2024 is part of the Government’s response to these reports, and a testament to Figen Murray’s resolve. A new “Protect Duty”, for the first time mandated by law, is being introduced to ensure that the type of premises most likely to be targeted by terrorists take proportionate measures to protect the public. It will forever be known as “Martyn’s Law”.

A “Standard Duty” will apply to “qualifying premises” with a capacity of 200-799 persons. These premises must put in place “public protection procedures”. An “Enhanced Duty” will impose further requirements on premises with a capacity of 800 plus who must, in addition to the standard duty procedures, put in place “public protection measures”. Whilst “procedures” are reactive to an attack, the enhanced “measures” are proactive and preventative.

The Bill also introduces amendments to the Licensing Act 2003 to ensure that plans for sensitive premises submitted with a new premises licence application, or attached to an existing licence, can be kept off the public register so its disclosure does not assist bad actors in carrying out their criminal acts.

The Bill had its First Reading in the House of Commons on 12 September 2024 with its Second Reading on 14 October 2024. It will impact some 178,900 venues. A great deal, but by no means all, will be premises licensed for the sale of alcohol and provision of entertainment under the Licensing Act 2003. But its impact will be wider than bars and nightclubs, theatres and cinemas, restaurants and sports arena. It will also cover educational facilities, museums, leisure facilities, parks, council and civic buildings, many of which will be owned or operated by local authorities.

The regulator has been revealed as the Security Industry Authority (“SIA”). The SIA, until now best known to local authorities and the trade as the licensing authority for door supervisors, will be producing guidance setting out how it proposes to exercise its functions under the Bill. In addition, Statutory Guidance – of a type familiar to licensing practitioners - will be issued by the Home Office regarding the discharge of requirements placed upon persons under the Bill. Whilst the majority of people and businesses are expected to comply with Martyn’s Law, a tough civil and criminal sanctions regime is being introduced to ensure compliance and enforcement.

The SIA’s enormous task will require the co-operation and support of the trade, responsible authorities and local authorities to further a common objective: the safety of the public promoted in an effective and proportionate manner.

This article summarises the main provisions in the Bill, as of October 2024. Amendments are likely during its legislative passage but, given this is a Government Bill with cross-party support, it should be expected that Martyn’s Law will become law. The main provisions will come into force on a date to be set by the Secretary of State to allow time for businesses to get ready to meet their new legal duties.

This article will consider:

What premises and events are in scope?
The requirements on standard-tier and enhanced-tier premises.
Who is the responsible person with duties under the new law?
Regulation, sanctions and enforcement.
Sensitive Information in Licensing Applications (“SILA”) – Licence Plans.
The potential impact on the licensing regime under the Licensing Act 2003.

The new Bill contains significant differences to the earlier drafts previously consulted upon. We begin with a survey of the undulating legislative process to date.

Legislative background & principal changes from draft Bill

The Bill’s proposals have been developed following extensive engagement with security partners, the police, businesses, victims’ groups, and parliamentarians.

In July 2021 the previous Conservative Government held an 18-week consultation on making the public safer at publicly accessible locations. 70% of respondents agreed or strongly agreed that those responsible for publicly accessible locations should take appropriate and proportionate measures to protect the public from terrorist attacks. 70% of respondents also agreed that responsible venues and organisations should prepare their staff to respond appropriately in the event of a terrorist attack.

In May 2023, the previous Government published a draft Bill which underwent pre-legislative scrutiny conducted by the Home Affairs Select Committee. The Committee subsequently published their pre-legislative scrutiny report, on 27 July 2023. Particular concerns were raised about the burdens on small businesses, and efficacy, of the standard tier duty.

In February 2024 the previous Government conducted a consultation specifically on the Bill’s proposals for standard duty premises. The responses were mixed.^[2]

The Government indicated that it “has reflected on commentary on the Bill to date and has made several changes since its publication in draft in May 2023, with the intention of ensuring a better balance between protecting national security and the burden on businesses and other organisations”.^[3]

Various changes to the original proposals in the draft Bill are reflected in the new Bill as follows:

The requirements for standard duty premises have been refined. The requirements for the completion of a mandatory Standard Terrorism Evaluation form has been removed – in recognition that a one size fits all approach is not appropriate and could be onerous.

As there is no longer a requirement for generic training, those in scope will be required to ensure that the relevant individuals at premises and events should be trained, or otherwise educated, to effectively implement the procedures and measures.

Furthermore, the ‘reasonably practicable’ test has been extended to the standard duty premises requirements, which will allow organisations to tailor the implementation of their procedures to their specific circumstances.

Significantly, the Government has also increased the threshold for bringing premises into scope as qualifying premises. Previously, premises with capacity for 100 – 799 people would have been in scope and so subject to the Bill’s requirements. Now, only premises that reasonably accommodate 200 or more individuals will be qualifying premises and, where they only accommodate fewer than 800, they will be standard duty premises.

Qualifying premises

Premises are qualifying premises, and so subject to the Protect Duty, if they satisfy all of these criteria:

The premises consist of a building or a combination of a building and land (e.g. a pub and its beer garden or a hotel with outside grounds used for dining and events). For these purposes a building also includes a part of a building (e.g. a unit within a shopping centre) or a group of buildings (e.g. a group of buildings that together form a university campus). (This criterion does not cover a piece of open land without a building, but activity on this land may well amount to a “qualifying event”, considered further below).

They are “wholly or mainly” used for one or more Schedule 1 uses (see below for Schedule 1 uses, it includes the sale of food and drink to members of the public for consumption on the premises). The term ‘wholly’ captures premises that are solely used for one or more Schedule 1 activities. The term ‘mainly’ captures premises which have more than one use, and at least one use is a use that is set out in Schedule 1. Whether premises are used mainly for one use or for another will be determined based on the circumstances of each set of premises. The amount of time used for each will be a key factor; and if the premises are used for one or more Schedule 1 uses for a greater amount of time during the year compared to the amount of time that they are used in other ways, then the premises will very likely fall within scope. For example, an exhibition hall hosting both public and private events, will likely be within scope of this criteria where the usage for public events exceeds the duration than that for private events.

It is reasonable to expect that from time to time 200 or more individuals may be present on the premises at the same time in connection with the Schedule 1 use or uses; and

The premises are not subject to any of the exemptions that are set out in Schedule 2.

Where the qualifying premises is not mainly used for Schedule 1 activities, the premises may still meet the “qualifying event” criteria (considered below)

Schedule 1 Uses

An important criterion for a Premises (but not Event) to be in scope of the Bill is that it is “wholly or mainly” used for one or more Schedule 1 uses. These uses include:

Retail shops
Premises for sale of food and drink for consumption on site (e.g. restaurants & bars)
Nightclub, social club or dance hall
Entertainment venue (e.g. a theatre, cinema, sports, music)
Sports ground, recreation, exercise or leisure centres
Libraries, museums and galleries
Exhibition halls and conference centres
Visitor attractions (of historic, touristic or educational value)
Halls, hotels, hostels and holiday parks
Places of worship
Hospitals/health centres
Bus/coach & railway stations
Schools, colleges & universities
Public authority buildings (e.g. town halls).

Relevant Schedule 1 use of a premises

There are many premises which are used for more than one Schedule 1 activity. The responsible person for a premises needs to determine the “relevant Schedule 1 use” so they can consider the applicable provisions in Schedule 1. Where there are two or more Schedule 1 uses at a premises “the relevant Schedule 1 use” is “the principal use” of those activities.

For example, a hospital building may have parts for use as a hospital, and other parts for retail and food and drink purposes. Whilst it is likely to be relatively simple to conclude that the majority of the building is for use as a hospital and that is its principal use, there are other premises where the consideration may be more complicated. For example, a sports ground may only operate as a sports ground most Saturdays during the year, but at other times it lets out its facilities every weekday, and during weekends in the off season for meetings, conferences and events. Those other uses are of a greater frequency than the uses for sports, however they are for a secondary purpose to its principal use as a sports ground. To ensure responsible persons understand how the circumstances at their premises relate to this determination, the Secretary of State intends to publish detailed guidance with case studies ahead of the measures coming into force.

Part of a building

The definition of a building includes “part of a building”. There are many buildings which will be used for non-Schedule 1 activities, but which have a part which is used for a Schedule 1 activity. For example, a large factory may have an associated shop for the display and sale of the goods it makes. The factory is a private workplace not in scope. The shop as part of the building may be in scope where it meets the qualifying premises criteria.

A group of buildings

There are many premises which consist of “a group of buildings” used for Schedule 1 use/uses. Common examples include buildings (and associated land) at a university campus or a hospital complex. Factors which define a group of buildings are that they are in close geographical proximity, and the responsible person is the same for the buildings in the group (or the majority of those buildings, recognising that the responsible person may have let a building out under lease or licence, or have control of aspects of procedures or measures).

At groups of buildings, the aim is to ensure that there is a co-ordinated approach to the consideration and delivery of procedures and/or measures, so that the requirements are delivered effectively and consistently at the group and ensure the safeguarding of the public at the premises.

Premises within premises

There are examples of premises that will be in scope of the Bill which will have multiple units within them, such as a shopping centre or an entertainment complex.

If shops within shopping centres (and similar examples of smaller units within buildings) meet the scope criteria of the bill, they themselves will be a qualifying premises in addition to the shopping centre (or other larger building). Which tier they fall into will depend on how many individuals are present on the premises at the same time. Those responsible for each part or unit will be required to co-ordinate, where necessary, with the responsible person for the overarching building to ensure that the procedures/measures they have in place meet the requirements.

Premises subject to different accommodation criteria

Schedule 1 provides that certain types of premises are standard tier or enhanced tier regardless of the number of individuals who can reasonably be expected to be hosted there. These are set out below.

All places of worship that can be expected to host 200 or more individuals at the same time will fall within the standard tier (even if that number is 800 or greater). The Government has indicated that it has taken this decision due to the differing nature of places of worship from other premises in scope, in being readily accessible and welcoming to all, with no restrictions on entry, or staff routinely present. For many places of worship there are mitigations in place, including those developed with local police and through Government funding and work programmes to support them to reduce their vulnerability to terrorism and hate crime.

Buildings used for childcare or primary, secondary or further education that can be expected to host 200 or more individuals at the same time will always fall within the standard tier regardless of their maximum numbers. Existing safety and safeguarding policies and procedures mean there are already a range of measures and procedures in place at these establishments. These include, for example, access control, lockdown and evacuation processes. The operating environments for these establishments are significantly different to higher education premises (e.g. Universities), which are usually freely accessible to members of the public and/or may frequently be accessed by the public for different events. As such, higher education premises will be subject to the same requirements as other types of premises.

Excluded premises

Schedule 2 of the Bill excludes certain premises from the requirements of the Bill as set out below:

Parliaments and devolved governments. Premises occupied for the purposes of either House of Parliament; the Scottish Parliament or a part of the Scottish Administration; the Senedd Cymru or the Welsh Government; or the Northern Ireland Assembly or a Northern Ireland Department, are not in scope of the Bill. This, according to the Government, is because these premises already have existing security procedures and measures in place, which are comparable to the Bill’s requirements.

Parks, gardens, recreation grounds, sports grounds and other open-air premises used for recreation, exercise or leisureare excluded, unless they have individuals employed or otherwise engaged to secure or check that members of the public who wish to access the premises have paid to do so or have invitations or passes allowing access. The Government considered that these are appropriate conditions to bring these types of premises (primarily open-air premises used for outdoor activities), within scope, and to ensure that the responsible person has the capacity and capability to meet the requirements.

Transport premisesthat are already subject to existing legislative requirements (e.g. at applicable airports, national rail and underground premises, international rail premises, and port facilities) to consider and mitigate threats are exempt. This is because the Government considers these existing requirements achieve comparable outcomes to those intended by the Terrorism (Protection of Premises) Bill.

Qualifying events

Events will be in scope – i.e. events at which the requirements must be fulfilled – if they are a “qualifying event”. Schedule 1 uses do not apply to events. An event is a qualifying event if it satisfies all these criteria:

(a) the premises where the event is to be held consists of a building (including part of a building or a group of buildings), other land (such as a field, park, or farmland) or a combination of a building and other land;

(b) the premises at which the event is to be held are not enhanced duty premises and do not form part of enhanced duty premises (such events are excluded as the premises will already be subject to the enhanced duty requirements);

(d) it is reasonable to expect that at some point during the event 800 or more individuals may be present at the event at the same time;

(e) the event is not excluded by virtue of a provision of Schedule 2 to the Bill; and

(f) individuals will be employed or otherwise engaged to control access to the event. Specifically, this will involve checking tickets or passes (whether paid for or free) or taking payment.

Events within qualifying premises

A qualifying event can occur within standard duty premises. The event must meet the criteria, including satisfying the express permission requirement. An example of this might be a pub that usually falls within the standard tier. However, the pub hosts a one-off music event, with over 800 attendees, by using the pub itself and occupying land such as a garden. Attendees must purchase a ticket to enter the event, and staff will be checking that attendees have a ticket before they enter the event. In such a scenario, the specific event will be treated as a qualifying event. However, the pub will remain within the standard tier when not part of the music event for that one weekend.

In this scenario, the responsible person could be the same entity in both scenarios; however, they could also be different entities. (See below for further consideration of the “responsible person”).

Excluded events

Schedule 2 to the Bill excludes certain premises or events that would otherwise fall within the scope of the requirements.

Events will not constitute a qualifying event if they occur at certain premises which are subject to specific provisions in Schedule 1 that require them to be treated as standard tier premises irrespective of the number of individuals that they host.

Specifically, these premises include:

places of worship: all such premises that can be expected to host 200 or more individuals at the same time will fall within the standard tier (even if that number is 800 or greater). An event that occurs at these premises will not constitute a qualifying event and, as a result, will not fall within the enhanced duty.

premises used for childcare or primary, secondary, or further education: all such premises that can be expected to host 200 or more individuals at the same time will always fall within the standard tier, regardless of their maximum number. An event that occurs at these premises will not constitute a qualifying event and, as a result, will not fall within the enhanced duty.

Examples of qualifying events

The Government has provided three illuminating examples of qualifying events:

Example 1: A music event that takes place in a park or field. The event is open to the public and will have over 800 individuals attending. Attendees must purchase a ticket in advance of the event, and staff will be checking that attendees have a ticket before they enter the event.

Example 2: An event that takes place in a premises that is not usually open to the public, and the premises therefore do not fall within the Bill’s scope. However, the event is open to the public and will have over 800 individuals attending. The event is free; however, attendees must register online to attend the event. Staff or volunteers will be checking that attendees have registered before they enter the event.

Example 3: An event that takes place at premises which falls within the standard tier, and the premises are not used as a place of worship, or for childcare, primary, secondary, or further education. The premises host an event on the weekend which is open to the public and will have over 800 individuals attending. Attendees must purchase a ticket in advance of the event, and staff will be checking that attendees have a ticket before they enter the event.

Capacity considerations

The legislation requires responsible persons for premises and events to assess a reasonable figure for the number of individuals who can be expected to be in attendance. This assessment will inform if a premises or event is in scope of the Bill and, if so, whether in the enhanced or standard tier (alongside the other qualifying factors).

Premises will be qualifying premises only where it is reasonable to expect that they will host 200 or more individuals at the same time (from time to time) in connection with any Schedule 1 activities.

Events will be qualifying events only where it is reasonable to expect that they will host 800 or more individuals at the same time at some point during the duration of the event.

The new Government has moved away from requiring a formal assessment of the capacity of premises, the approach set out in the previous draft Bill, due to its lack of flexibility. Instead, this new method is believed to enable a more accurate representation of the number of individuals at premises. The Government’s view is this provides for a fairer basis for responsible persons to understand whether their premises meet the qualifying thresholds.

The responsible person can draw from a range of methods when assessing the number of individuals who may reasonably be expected to be present at their premises or event. This includes methods which the responsible person may already be familiar with, e.g. safe occupancy calculations for the purposes of fire safety or use of historic data.

The assessment should take into account the total number of individuals who may reasonably be expected to be at the premises.

How to establish reasonable expectation of individuals present

The Government has indicated that a responsible person can use any reasonable method of assessing the number of individuals who may be expected to be present at the premises at the same time, including:

1. Safe occupancy for fire safety purposes

Many types of premises have a safe occupancy number for fire safety purposes (i.e. the number of individuals who may safely be accommodated at the premises). That safe occupancy number is calculated in accordance with the methods set out in relevant guidance. For example, the guidance that accompanies the Building Regulations 2010 sets out two methods to determine how many individuals can safely be accommodated inside a building (or equivalent structures).

The first uses floor space factors to establish a maximum density of individuals depending on how that area is used. The second, identifies an exit capacity to determine the maximum number of individuals based on the number and width of exits.

The lowest figure of the two calculations determines safe occupancy (of individuals) for fire safety.

A responsible person may assess the number of individuals who can reasonably be expected to be at their premises at the same time based on the number of individuals who can safely be occupied at them. This method of assessment may be suitable in particular in cases where the responsible person does not know the actual numbers of individuals who attend the premises.

Example: A café on the high street, sells food and drink establishes a fire safety risk safe occupancy figure of 250 individuals at the premises, which is often full to capacity. The responsible person assesses that it is reasonable to expect 250 individuals at the premises at the same time.

2. Historic attendance data

Historic data showing actual usage and numbers present at a premises or event can be used to determine reasonable expectation of numbers. Data should reflect whether the standard or enhanced tier threshold has been met.

Example: A large pub’s fire safety risk assessment establishes a safe occupancy figure of 875 individuals at any single point in time. However, the pub’s historic data over the last 12 months shows actual usage by visiting members of the public has reached a maximum of 725 individuals (during seasonal periods, Summer and Christmas).

Using this data, the pub can demonstrate that it meets the standard tier threshold as the number of individuals who might reasonably be expected to be at the pub at the same time did not exceed 725 (over the last year) and is not expected to in its envisaged future usage.

3. Fixed seating and / or standing.

Depending on the nature of the business, the responsible person may use the number of fixed seats and/or fixed standing areas to contribute to an assessment of the number of individuals that it is reasonable to expect.

Example: A restaurant sells food and drink consumed by visiting members of the public in its building and in an area outside which comprises of tables and chairs for this purpose. The fixed seating, for both inside and out, holds a maximum of 450 individuals at any single point in time.

The responsible person assesses that it is often full to peak capacity, and that it is reasonable to expect 450 individuals at the premises at the same time.

4. Tickets and pre-registration

For premises or an event that limits attendance based on the sale of tickets or pre-registered attendees, the maximum number of tickets issued or those registered can be used to establish a reasonable expectation of the numbers of individuals who will attend.

Example: A music event, which is open to the public by purchasing a ticket prior to entry, takes place in a large field. A restriction is placed on the number of tickets issued to 900 individuals at the same time. Tickets are checked by security on entry. The event’s responsible person reasonably expects that 900 individuals reflects the number present when full (at the same time).

Example: A private warehouse decides to hold a one-off event which is open to the public. The event is free, with a requirement that individuals must register online prior to attendance.

The event organiser restricts attendance (through staff controlling the doors) for safety reasons to a maximum of 900 individuals at any one time. The responsible person assesses that it is reasonable to expect 900 attendees at the event.

5. Restrictions

If a responsible person for premises or an event imposes restrictions on attendance, they can use this figure to determine the number of individuals. For example, a maximum attendance/capacity figure attached to an alcohol and entertainment licence or Temporary Event Notice under the Licensing Act 2003.

Example: An event takes place in a standard duty qualifying premises (building). The premises does not fall within the exempted categories under Schedule 1. Over the weekend, the premises operator allows a gallery to use their premises to host a one-off art exhibition. The event organiser chooses to restrict the sale of tickets to 900 individuals per day; however, they also choose to stagger attendance.

This means no more than 200 individuals are at the exhibition at any one time. The responsible persons can use this restriction to demonstrate a reasonable expectation of 200 individuals will attend at the same time during the event. This would mean the event would not fall in scope of the bill.

6. Other means of assessing

There may be some premises which cannot use one of the above methodologies (1-5) for various reasons, or to do so would not represent an accurate representation of the actual usage of a premises and the number of individuals that it is reasonable to expect at the same time. Where that is the case, declarations can be undertaken using other means of assessing numbers, together with a justification as to why this is necessary, how the figure has been calculated, and how they know that the figure presents an accurate assessment.

Example: A garden centre consists of a building and a large outdoor area for the display and sale of goods. The operator does not count customer numbers and considers that its fire safety occupancy figure is significantly greater than the numbers who attend at peak times.

It uses its records of things like transactions and assessments of customers who visit without making purchases to provide an assessment of numbers present at the same time (during its busiest trading time).

Premises: Reasonable to expect from time to time

The assessment is as to the number of individuals who may be expected to be at the premises or event at the same time, from time to time. The reference to “from time to time” reflects the fact that many types of premises will experience fluctuations in the number of individuals that they host and will only host more than 200 or 800 individuals occasionally. Some premises may host the relevant number only on certain nights of the week, or at certain times of the year, but overall can reasonably be expected to host the number “from time to time”. Where that is the case, and similar attendance can be expected in the future, the premises will fall within scope. Time to time does not refer to an average attendance, for example over a day or a week.

Example: A responsible person may have assessed the number of individuals it is reasonable to expect as 180, but one day it unexpectedly has 250 individuals present. If this is a circumstance which would not have been anticipated, then the premises would remain out of scope.

However, if this becomes a repeat occurrence it can be expected it will fall within the standard tier.

Events reasonable to expect at some point

‘Reasonable to expect at some point’ is an assessment of the number of individuals that are expected to be present at the event. This entails considering the number of individuals expected to attend at the same time at some point over its duration.

Example: An event takes place in a field from Thursday to Sunday, which does not restrict ticket sales. The responsible person uses historical data to ascertain whether their event can reasonably expect 800 individuals to attend at any one point.

The reasonable expectation threshold is met bringing the event in scope for the entire 4 days, even if on some days the 800 threshold is not met.

Considerations when assessing number of individuals at qualifying premises and events

This assessment should include individuals working at a premises or event, unless the methods to establish numbers in attendance are tickets or pre-registration (events only).

Areas not featured in the assessment are the immediate vicinity of a premises or event (such as the pavement used by customers outside the pub’s entrance) and areas not accessible to or not used by members of the public (such as loading bay areas at an arena). As these areas could present vulnerabilities and necessitate security measures or procedures, whilst not applicable to the assessment of attendance figures, responsible for premises and events will be required to consider these areas within their requirements.

Standard Duty Premises

Standard duty premises are also referred to as the ‘standard tier’.

The requirements aim to ensure that those responsible for standard duty premises are better prepared to respond to a terrorist attack so that people working on the premises can take action that might save lives and reduce harm. The standard tier requirements are set out in the Bill:

1. Notification

The responsible person for standard duty premises will be required to notify the Security Industry Authority (SIA) when they become responsible for that premises. They must also notify the SIA when they cease to be responsible.

Regulations will set out the required time period for notifying the SIA, and what information must be provided about the responsible person and the premises.

2. Public protection procedures

The responsible person for standard duty premises will be required to ensure that, so far as is reasonably practicable, appropriate public protection procedures are in place at the premises.

Public protection procedures are procedures of a type set out in the Bill that may be expected to reduce the risk of physical harm to individuals in the event that an act of terrorism occurs at the premises or in the immediate vicinity. They are procedures to be followed by people working at the premises where they suspect an act of terrorism is occurring, or is about to occur, at the premises or in the immediate vicinity.

The four types of procedures that must be put in place, as appropriate and reasonably practicable, are:

Evacuation - the process of getting people safely out of the premises
Invacuation - the process of bringing people safely into, or to safe parts within, the premises.
Lockdown - the process of securing the premises to ensure that the entry of any attacker is restricted or prevented e.g. locking doors, closing shutters or using barriers.
Communication - the process of alerting people on the premises to move them away from any danger.

When considering the procedures in place, the responsible person will need to consider what is appropriate and reasonably practicable for their premises. This will involve consideration of the nature of the premises and resources available. The Bill does not require physical alterations or the purchase of equipment at standard duty premises.

The requirement has been designed with the intention of being simple for the responsible person to follow and the Government intends to provide guidance to support the consideration of reasonably practicable public protection procedures.

As part of ensuring that public protection procedures are in place, people working at the premises must be made aware of the procedures so that they can be ready to put them into practice. For example, it would not be sufficient to have an evacuation procedure in place if no one working on the premises understood how to follow it.

Types of acts of terrorism

To develop effective public protection procedures, the responsible person for standard duty premises will need to consider the different types of terrorist attack that could take place at their location and how the procedures in place reduce the risk of harm caused by such attacks.

The Government intends to provide comprehensive guidance to understand relevant types of terrorist attack methodologies.

Reasonably practicable

“Reasonably practicable” is a concept found in other regimes, such as Fire Safety and Health and Safety. In determining what is reasonably practicable, the responsible person will need to take into account their particular circumstances, including the nature of the premises and the resources available to them.

The particular procedures put in place at one location may not be appropriate and reasonably practicable at another. For example, procedures will differ at a shop that can reasonably expect to have no more than 200 people on the premises at any one time from a restaurant that can seat 400 people. Procedures should be tailored to the specific circumstances of the premises.

The Government has provided examples for different types of premises which set out its expectations in relation to standard duty premises.

Example 1: A 200-capacity shop may assess that it is appropriate and reasonably practicable to put in place the following public protection procedures:

Evacuation - there will be one route through the main entrance that leads into the car park at the front of the shop and another through the back door that leads into an exterior area.
Invacuation - bring individuals into the main floor of the shop and into the back storage room, that has secure windows and a modern lock that is routinely checked.
Lockdown - a sophisticated process would not be required. As such, it is sufficient for a nominated person to simply use the lock on the front door in the event of an attack occurring outside.
Communication - met by setting out the above procedures in a one-page summary and circulating with relevant individuals that work at the shop.
Supporting activities - a poster summarising the procedures is placed in a private staff area of the shop and a landline is present.
The procedures are reviewed annually.

Example 2: A 400-seater restaurant may assess that it is appropriate and reasonably practicable to put in place the following procedures:

Evacuation - There will be one route via through the main entrance that leads onto public pavement and another through a side door that leads into an alley.
Invacuation - bring individuals into the main restaurant area and, if needed, into a variety of staff areas.
Lockdown - nominated individuals knowing when (i.e. when their shift manager instructs them to) and how to quickly lock and barricade doors, close window shutters and turn off lights.
Communication – met by ensuring staff know who will enact procedures (shift manager) and planning how to communicate with customers present at the restaurant, were an attack to occur.
Supporting activity - new members of staff are provided a short awareness briefing on the restaurant’s procedures at induction (alongside health and fire safety inputs).
The procedures are reviewed annually.

Effective procedures

The procedures will need to be effectively communicated to all those needed to deliver an effective response to a suspected incident. This may include employees, volunteers and contractors as well as those hiring premises. How people are made aware of the public protection procedures will depend on the particular circumstances of the premises (including the nature of their use and types of people working there) and the responsible person’s resources. For example, the responsible person may require relevant employees to attend instructional training.

Enhanced Duty

Enhanced duty premises and events are also referred to as the ‘enhanced tier’. These duties are in addition to those applicable to standard duty premises.

As with the standard duty, enhanced duty requirements are designed to ensure that responsible persons for qualifying premises and events are prepared to take appropriate actions in the event of an attack. As enhanced duty premises and events will reasonably be expected to host greater numbers of individuals, the impact of a successful attack is likely to be more significant; and so responsible persons will also be required to put in place reasonably practicable public protection measures. These measures aim to reduce vulnerabilities and therefore provide better protection from acts of terrorism.

The enhanced duty requirements are set out in the Bill as follows:

1. Notification

The responsible person for enhanced duty premises and events will be required to notify the Security Industry Authority (SIA) when they become responsible for the premises or event. They must also notify the SIA if they cease to be responsible.

Regulations will set out the required time period for notifying the SIA, and what information must be provided about the responsible person and the premises or event, such as the number of individuals the premises or event can reasonably expect to be present and contact information relating to the responsible person.

2. Designated senior individual

Where the responsible person for an enhanced duty premises or event is not an individual (e.g. a company or partnership), they must appoint a designated senior individual (DSI). The DSI must be someone who has responsibility for managing the affairs of the responsible person as a whole, such as a director or partner, rather than a lower-level employee.

The primary function of the DSI is to ensure that the responsible person complies with the relevant legislative requirements with a wider objective of ensuring senior management are engaged in decision-making. The DSI may delegate actions that relate to the requirements but cannot delegate their overall responsibility.

The DSI will not be held accountable for an organisation’s failure to meet requirements where they have done everything within their capability to ensure the organisation complies with requirements. Senior officers (including the DSI) may be liable to prosecution under the Bill if their organisation commits an offence and it is proved that the offence was committed with their consent, connivance or occurred as a result of their neglect.

3. Public protection procedures and measures

Public protection procedures

The responsible person for enhanced duty premises and events will be required to ensure that, so far as is reasonably practicable, appropriate public protection procedures are in place at the premises or event. These are the same as those expected from standard duty premises (see above).

Public protection measures

The additional requirements of the enhanced duty are designed to ensure that responsible persons for qualifying premises and events deliver appropriate mitigations to provide greater protection against acts of terrorism. Such mitigations are known as “public protection measures”.

To be effective, the responsible person should ensure that the public protection measures that they put in place are tailored to their particular premises or event. This includes how they operate, their resources and the types of acts of terrorism that could occur there. It will be imperative to consider the effect of all measures when integrated together, to form an accurate understanding of how their vulnerabilities will be reduced in order to mitigate the impact of a terrorist attack, should one occur.

The delivery of these measures will vary between different types of qualifying premises and events and may be implemented through people (e.g. training), processes (e.g. a bag search policy) or physical measures (e.g. CCTV). The measures will also need to be delivered holistically, for example, installing CCTV would not address a vulnerability if it were not operated by people who have appropriate awareness of relevant threats. The four types of measures that must be put in place, as appropriate and reasonably practicable, are:

Measures in relation to monitoring the premises or event, and their immediate vicinity:

Monitoring measures focus on identifying and reporting signs of suspicious activities, behaviours, items or other potential indicators of a potential or actual terrorist attack at a premises or event, and their immediate vicinity, to protect members of the public. Examples of such measures range from circulating awareness-raising material to those working at the premises or event, to comprehensive security systems and control rooms at the higher end of the scale.

Measures in relation to controlling the movement of individuals into, out of and within the premises or event:

Movement measures focus on employing appropriate deterrents and mitigations to reduce vulnerabilities to attacks and to protect members of the public entering, within and exiting the premises or event. Examples of such measures range from policies and processes for observing suspicious bags, searching and screening individuals, locks and barriers or CCTV.

Measures in relation to the physical safety and security of the premises or event:

Physical safety and security measures focus on the strengthening of premises and events structures to prevent certain attack methodologies from occurring and/or to mitigate their impacts. Examples of such measures range from stand-off zones (a designated area to place distance between one location and another), safety glass or Hostile Vehicle Mitigation.

Measures in relation to the security of information which may assist in the planning, preparation or execution of acts of terrorism:

This focuses on understanding the sensitivities of information, particularly what is appropriate to share, where and who with. It may include key information about the premises or event, operating environment, design or usage that could reveal vulnerabilities. An example of this measure is ensuring that sensitive information such as floor plans are held securely, and access is restricted to relevant individuals.

The Government intends to provide comprehensive guidance for enhanced duty premises and events to support the understanding, development and implementation of reasonably practicable public protection procedures and measures.

Reasonably practicable

“Reasonably practicable”, in the context of enhanced duty premises, recognises that the particular procedures and measures put in place at one location may not be appropriate and reasonably practicable at another. For example, procedures and measures will differ at a cinema that can reasonably expect to have no more than 1,000 people on the premises at any one time from a stadium that can seat 20,000 people. Procedures and measures should be tailored to the specific circumstances of the premises or event.

The Government has provided examples that illuminate the expectations on different types of enhanced duty premises.

Example 1: A 1,200-capacity theatre may take forward the following activities in relation to implementing their public protection procedures and measures:

Developing and implementing plans for public protection procedures and ensuring that they are routinely rehearsed.
Ensuring that induction and probation periods for new staff include awareness training packages for all those working at the theatre in roles relating to safety, security and counter-terrorism.
Developing policies for perimeter and entry checks as well as queue management and ticket checks.
Using internal radio systems and mobiles for communication between relevant individuals working at the theatre.
Introducing interim tabletop activities and walk-through scenarios that are designed and led by designated individuals.
Employing a mixture of salaried and contracted door staff to sufficiently protect ingress and egress areas.
Developing policies for suspicious or restricted items including bag checks and storage.
Having effective CCTV with an adequately staffed monitoring and control room.

This list is non-exhaustive and subject to change over time.

Effective procedures and measures

The procedures and measures should be effectively communicated to all those who need to be aware of them in order to deliver an effective response to a suspected incident. This may include employees, volunteers and contractors as well as those hiring premises.

4. Documenting compliance

Responsible persons for enhanced duty premises and events are required to record the following information to form a tailored document:

the public protection procedures that they have in place, and/or will put in place, to remedy or mitigate relevant risks
the public protection measures that they have in place, and/or will put in place, to remedy or mitigate relevant vulnerabilities or risks
reasoning as to how those public protection procedures and measures reduce the vulnerabilities and/or risk, were a terrorist attack to occur

The document should focus on the totality of the procedures and measures in place and contain the necessary detail to enable the SIA to make an initial evaluation of compliance. This might form part of a remote assessment or support an on-site inspection and it is therefore critical that the SIA can develop a clear understanding of the vulnerabilities of the premises or event to the different attack methodologies.

The document should be provided to the SIA as soon as reasonably practicable after it is prepared and resent within 30 days of any revision.

The responsible person

The Bill defines who is responsible for “qualifying premises” or a “qualifying event”, and therefore who is responsible for meeting the relevant requirements. This “responsible person” can be an individual or a company (among other legal entities). In case of companies, see the discussion on Designated Senior Individuals above.

The responsible person for qualifying premises 

For premises, the responsible person is the person who has control of the premises in connection with their Schedule 1 use/s (e.g. the use of a building as a sports ground or a nightclub). The responsible person will usually be the premises operator, e.g. if a person leases a building for retail use as a shop and is in control of the building for that use, they will be the responsible person. Similarly, the person in control of the premises might be the organisation which operates a theatre or the company which holds the lease for and operates a shopping centre. Where a party is appointed as a contractor to carry out work at the premises, but that party has only limited control over the premises (for example, a security guarding company that is appointed to provide door staff at a nightclub) it is highly unlikely that they will be the person responsible for the premises in connection with the relevant Schedule 1 use.

The responsible person for qualifying events

For qualifying events, the responsible person is the person who has control of the premises at which the event is to be held for the purposes of that event. The relevant circumstances of the event will need to be considered to determine who the responsible person is. For example, if a concert is to be held in a park and the company putting on the event takes control of an area of the park and has control of that area for the purposes of that concert, the company putting on the event will be the responsible person. Conversely, if a stately home puts on a concert in its grounds and maintains control of the site of the concert for the purposes of that event, the stately home will be the responsible person. This would be the case even if the stately home contracted organisations to do aspects of the event (e.g. to provide door security or ticketing).

Responsibility cannot be delegated to contracted services.

Co-ordination

If more than one person (including more than one company or organisation) is responsible for a qualifying premises or an event, they must, so far as is reasonably practicable, co-ordinate with each other in complying with the Bill’s requirements. If qualifying premises form part of other qualifying premises, they must, so far as is reasonably practicable, co-ordinate in complying with the Bill’s requirements. The type of co-ordination required will depend on the particular circumstances, but it is expected that responsible persons will combine efforts or actions to reach mutually effective outcomes. Two examples have been highlighted:

In a scenario where there are two responsible persons for a qualifying premises or an event, they should coordinate to ensure compliance with the relevant requirements. For example, a joint venture would mean that a premises or an event may have two responsible persons with equal control, and therefore responsibility.

In a scenario where qualifying premises form part of other qualifying premises; for example, a department store within a shopping centre. The department store and the shopping centre must, as far as reasonably practicable, co-ordinate to ensure that they are individually, and cumulatively, compliant.

The co-ordination requirements only apply to premises that fall within scope of the Bill. This means that smaller premises with a capacity of under 200 that are located within qualifying premises do not have any statutory requirement placed upon them.

Co-operation

If a person (“P”) has, to any extent, control of enhanced duty premises or premises at which a qualifying event is to be held but is not the responsible person for the enhanced duty premises or the event (“R”), the co-operation requirement will apply. This means that P must, so far as is reasonably practicable, co-operate with R to allow R to comply with the Bill’s requirements.

The co-operation requirement is designed to ensure that the responsible person can comply with the requirements placed upon them and, in instances whereby they require relevant permissions or support from those with control over the land of their building or event, there is a duty on such parties to co-operate, so far as is reasonably practicable. Two examples of co-operation, highlighted by the Government, might be:

Where the responsible person has identified that, in order to meet their legal obligations under the Bill, changes are required to the structure of the building. Their lease agreement requires that they seek -permission from the freeholder for any alterations. The freeholder is obliged to consider such requests to a reasonably practicable level.

Where the responsible person has identified the need to implement certain mitigations to meet their legal obligations under the bill and one of the measures requires freeholder permission. Their lease also states that they (the freeholder) should contribute a certain percentage of costs to ensure premises remain fit for purpose. The freeholder is obliged to consider such requests to a reasonably practicable level.

If there is a dispute, the appeal tribunal may be asked to determine whether a person is a responsible person or the extent to which a person who is not a responsible person has control of premises.

The Regulator, Sanctions & Enforcement

The regulator: the Security Industry Authority (“SIA”)

The role of the regulator will be to provide advice on complying with the requirements in the Bill, supporting those responsible for qualifying premises and events to meet their obligations and determine what reasonably practicable procedures and measures should be put in place.

However, the SIA will also have available the necessary tools to address instances of persistent or serious non-compliance. The SIA will have powers to issue a range of civil sanctions and the regime is underpinned by relevant criminal offences and investigatory powers.

Powers to access premises and events to conduct inspections

An inspector may enter premises after giving 72 hours’ notice to inspect and observe activities. Where access is required with fewer than 72 hours’ notice, access is denied, or giving notice would defeat the object of entry, the inspector may apply for a warrant to gain access to the premises.

During an inspection, the inspector will be able to view documents and equipment and require any person on the premises to assist with the inspection (e.g. providing an explanation of the documents). They will be able to remove items, documents or equipment as evidence or for the purpose of further investigation where copies are unavailable.

An inspector may also be accompanied on their inspection by other individuals to assist with the inspection (e.g. a technical expert to advise on specific security measures).

Powers to gather information

An inspector will be able to issue a notice to require information to be provided for the purpose of assessing compliance. This can include the provision of information, i.e. providing documents relating to security at the location, or arranging an interview with a relevant person, such as people working at the premises. For example, they may ask questions of the head of security in relation to specific aspects of their measures.

Sanctions

Where there are instances of non-compliance, the SIA will be able to issue a range of civil sanctions including compliance notices, monetary penalties and restriction notices. The Bill also includes some criminal offences. How and when these powers will be used by the SIA will be published in guidance.

Civil sanctions

The Civil Sanctions available under the Bill are as follows:

Compliance notices - these will require non-compliance to be remedied within a specified timeframe and could require specific actions to be undertaken.

Restriction notices - these can only be issued in relation to enhanced duty premises and qualifying events. They could require the temporary closure of premises, prohibit an event from taking place, or impose certain restrictions on the premises or event (e.g. limit the number of people who may attend at any one time) until suitable measures are in place. They will only be used in exceptional circumstances, where the restrictions are necessary to ensure public safety by protecting people from physical harm.

Penalty notices - the SIA will be able to issue variable monetary penalties up to a maximum of £10,000 for standard duty premises and £18m or 5% of worldwide revenue for enhanced duty premises or qualifying events. These will generally only be issued after a compliance notice or restriction notice has not been complied with.

Daily penalties - where a compliance or restriction notice has been issued, the SIA will also be able to issue daily penalties (up to £500 per day for standard duty premises and £50,000 per day for enhanced duty premises or qualifying events) where non-compliance continues after the date the original penalty is payable. When determining the amount of a penalty, the SIA will take into account the effects of non-compliance, mitigating action taken to remedy it or its effects, and the person’s ability to pay. How the SIA will exercise these functions will be set out in guidance.

The SIA will be required to notify the affected party before they issue any of the above notices and give them an opportunity to make representations (unless there is an urgent need to issue a restriction notice).

Where a notice is issued by the SIA, there is a right of appeal to the Tribunal.

Criminal offences

It will be an offence to fail to comply with an information notice, provide false or misleading information, obstruct the SIA or impersonate an inspector.

Where a compliance or restriction notice is issued in relation to enhanced duty premises or a qualifying event, it will be an offence to fail to comply with the notice. Penalty notices may be issued to address such non-compliance but not where the person has already been convicted of an offence.

The offences are either-way and so can be tried in the magistrates’ court or Crown Court. The maximum sentence available to a magistrates’ court is 6 months imprisonment and/or an unlimited fine. In the Crown Court, 2 years imprisonment and/or an unlimited fine.

Appeals Tribunal

The Bill permits certain contentious issues to be appealed to the (existing) First Tier Tribunal by either the SIA or any person who has (or in relation to an event, will have) control to any extent of the premises or event.

The appealable issues include:

the identification of the “responsible person”
whether premises are qualifying premises or events are qualifying events
whether qualifying premises are subject to the enhanced duty
the relevant Schedule 1 use of qualifying premises
whether a person is required to cooperate under the law
challenges to compliance, restriction and fixed penalty notices.

SILA : Licence Plans

A procedure to manage Sensitive Information in Licence Applications (“SILA”) has long been touted. It has now been included in the Bill which provides for the amendment of the Licensing Act 2003 and the Licensing (Scotland) Act 2005 to prevent sensitive information in premises plans being available to the public, where this is considered necessary to reduce the risk of this information potentially being used to assist terrorist activity. Some local authorities (notably Westminster City Council) already operate a non-statutory procedure to prevent plans for sensitive premises falling into the wrong hands. A similar scheme already exists in the planning regime (“SIPA”).

Although details will follow in regulations, Schedule 4 of the Bill mandates that all new licence applicants applying for a premises licence, club premises certificate or provisional statement in England, Wales and Scotland will be required to supply two plans to the Licensing Authority in support of the application.

The first plan will be a detailed plan for the Licensing Authority’s use, whilst the second plan - which is the new component of this provision - will be a less detailed plan that will be made available for public inspection.

In addition, the Bill requires, on the application of the holder of a premises licence or club premises certificate, plans held by a Licensing Authority which contain sensitive information to be removed from the public register and replaced with a modified version of the plan

Financial implications

The total public sector cost of the regulator (“SIA”) has been estimated by the Government to be between £32.2 million and £72.1 million with a central estimate of £48.7 million. This includes the cost of the 10-year cost of the regulator itself, which is estimated to be between £30.5 million and £68.1 million with a central estimate of £46.6 million. Additionally, there is a spend of between £1.6 million and £4.0 million with a central estimate of £2.1 million in Criminal Justice System costs for the regulator’s actions. This gives a total public sector cost of £32.2 million and £72.1 million with a central estimate of £48.7 million.

There will be cost borne by both local authorities and central Government in bringing the sites they own and operate into compliance with the Bill.

There will be economic costs of lost productive time for standard duty premises with a central estimate of £3,310 per site (10-year cost) for the cost of bringing sites into compliance. It is estimated there are 9,100 sites which are owned by local authorities and an unknown number of sites owned by central Government which includes an estimated 22,990 schools which will be subject to the requirements of the Bill. For just the education component of the Bill, the cost to Government is estimated to be £7.6 million per year. The cost of bringing these sites into compliance will be borne by local authorities and central Government.

For enhanced duty premises, both private owners and local authorities could face a cost of £52,100 per site (10-year cost) to bring them into compliance with the Bill according to Government estimates.

Interaction with Licensing Act 2003

Whilst the only direct change to the Licensing Act 2003 is in relation to sensitive licence plans, Martyn’s Law will have a significant impact on licensed premises and events - a great many of which will be within the scope of the Bill. If a venue operating under a premises licence is found to be operating in breach of the Protect Duty then one can envisage a licence review being actively considered by the responsible authorities as a breach is likely to directly impact on the public safety licensing objective. Depending on the facts, protecting children from harm and the prevention of crime and disorder objectives may also be engaged.

During the application stage, responsible authorities would be entitled to question applicants for a new licence on their plans to comply with Martyn’s Law, once it is in force. Inadequate answers from the applicant may lead to representations objecting to a grant.

Conclusion

Some operators are set against further mandatory regulation amid concerns that the costs and time involved to ensure compliance are burdensome, particularly given the tough economic climate faced by the hospitality sector. Questions have been raised as to the efficacy of the measures: will they actually prevent an attack? Others have proposed a more generalised Protect Duty to be enforced through existing regulatory regimes (such as the premises licensing system). The Bill is the Government’s attempt to balance the need to protect the public against very real terrorist threats with the costs on businesses of taking measures that achieve that end. Whether it achieves its aim, and at what cost, remains to be seen. It is incumbent on us all to do whatever we reasonably and professionally can to make Martyn’s Law a success.

Gary Grant is a Barrister at Francis Taylor Building chambers.

^[1] https://www.rand.org/randeurope/research/projects/2018/the-cost-of-terrorism-in-europe.html

^[2] https://assets.publishing.service.gov.uk/media/66e312f30d913026165c3de6/FINAL_ST_Consultation_results.pdf

^[3] Explanatory Notes to Bill