Sports, entertainment, health and education venues face terrorism ‘protect duty’

Publication of the Terrorism (Protection of Premises) draft Bill (56-page / 580KB PDF) by the Home Office reflects its previous pledge to impose a new ‘protect duty’,  requiring venue operators to consider the risk of terrorist attacks and to take proportionate and reasonable measures to prepare and protect the public.

The Home Office committed to introducing the new protect duty in the aftermath of the 2017 Manchester Arena bombing, when 22 people were killed as they left an Ariana Grande performance. It consulted on the proposals in 2021 and received 2,755 replies. The consultation formed part of the government’s manifesto commitment to improve public security in the face of ongoing terrorist threats and to create a culture of safety, harnessing private sector resources to drive improvements. The government published its response to the consultation in early 2022.

The new duty will apply to “qualifying public premises”.  Qualifying public premises are essentially those to which the public have access, have a capacity of 100 or more individuals, and are primarily used for specified purposes. Those purposes are widely defined by reference to a schedule to the draft Bill and include venues for entertainment, leisure, retail, food and drink, museums and galleries, sports grounds, public areas of local and central government buildings such as town halls, visitor attractions, temporary events, places of worship, health, and education.

For open air venues in scope of the proposed new duty, access for the public must be by express permission only, with or without payment.

The draft Bill splits qualifying public premises into two tiers, with particular requirements applying to premises in each tier. Standard duty premises are premises with a capacity of 100 to 799, whereas enhanced duty premises have a capacity of 800 or over. The draft Bill allows for provision to be made for some qualifying premises to be treated as standard duty premises when they would otherwise be enhanced duty premises, and vice versa.

Responsibilities are also imposed on those in control of “qualifying public events”. These are public events held at premises that are not qualifying public premises with a capacity of 800 or over, where express permission is required to enter for the purpose of attending the event, with or without payment.

The public capacity of premises and events will be determined in accordance with regulations made by the secretary of state.

Standard duty requirements have been developed “to ensure there is a baseline level of protection and preparedness throughout the UK”, according to security minister Tom Tugendhat. They include a requirement to undertake a standard terrorism evaluation of the premises, which will include an assessment of the types of terrorism most likely to occur at or in the immediate vicinity of the premises and the measures in place to mitigate this risk and protect the public, including procedures to evacuate their premises. This must be regularly reviewed – at least every 12 months and whenever there is a material change.  A copy must be made available to workers and relevant workers – those with appropriate responsibilities – must also be given appropriate terrorism protection training.  

Persons responsible for qualifying public premises or qualifying public events will also be required to ensure that terrorism protection training is provided to relevant workers at their premises. In addition, those responsible for enhanced duty premises and qualifying public events must appoint an individual as the designated senior officer for the premises or event and must complete and regularly review their terrorism risk assessment. In completing this assessment, they must consider the types of terrorist act most likely to occur at or around their premises or event and the ‘reasonably practicable’ measures that might be expected to reduce the risk of such an act occurring, or the risk of physical harm to individuals as a result of such an act. They must also implement reasonably practicable security measures to reduce the risk of, and harm caused by, terrorism. 

Persons responsible for enhanced duty premises or a qualifying public event must also prepare and maintain a security plan for the premises or event, with a copy provided to the regulator – this will be a public authority designated as the regulator in this context in regulations to be made by the secretary of state. Details of what will need to be included in the security plan will also be set out in future regulations but, according to the draft Bill, it would need to document, amongst other things, information about the premises or event, the persons responsible for the premises or event, and information arising out of compliance with the other requirements. 

The draft Bill also sets out the proposed enforcement powers of the regulator – a range of sanctions and penalties for non-compliance is envisaged. Civil penalties may be imposed as an alternative to criminal sanction in appropriate cases. For enhanced duty premises or a qualifying public event that may be up to £18 million or 5% of the operator’s worldwide revenue. The draft Bill also provides for criminal sanction for individual officers where a corporate entity commits an offence and it is shown to have been committed with the consent or connivance of that individual. 

In all instances, the government and the regulator will provide guidance and support to ensure that they “do everything possible to alleviate the burden on business”, Tugendhat said.

Health and safety law expert Kevin Bridges of Pinsent Masons said: “The draft Bill creates a framework for what appears to be a significant new duty on those responsible for premises or events in scope. This is in addition to existing duties under health and safety legislation to protect members of the public in respect of risks arising from the conduct of the enterprise or business. Questions remain, however, with much of the detail still to be set out in regulations to be made by the Secretary of State and guidance still to be provided.”

“The government has previously said that its aim is to ‘create a culture of security, with a consistency of application and a greater certainty of effect’. If this is to be achieved, it will have to ensure that the ask of those in scope is understandable and deliverable, and is a proportionate response to the risk, without unduly burdening business. Careful consideration will be required too as to the choice of regulator. The most obvious choice, the Health and Safety Executive, is already stretched, with significant new responsibilities already recently given to it. Considerable additional resource will be required if oversight of the protect duty regime is also to be added to its remit,” he said.