Martyn’s Law: new bill introduces mandatory terrorism prevention and protection regime for public premises

After much lobbying from the families impacted by the Manchester Arena bombings in 2017, we now have a draft of the so-called Martyn’s Law, named after Martyn Hett, who was killed in the attack.

Its full title is the Terrorism (Protection of Premises) Bill, and it is designed to introduce a mandatory regime for public premises to have to take proactive steps to ensure preparedness for, and protection from, terrorist attacks.

To date, the UK’s approach to this sort of security has been voluntary. While for larger-scale premises, this new law may well represent a codification of existing best practice, for others this will involve entirely new considerations and procedures. 

Much of the practical detail will be set out in Government guidance and further regulations to be published in due course but there is a lot that premises-owning clients can and should be doing now to anticipate this bill becoming law (which is expected to occur later this year or early next).

What premises and events will be in scope?

Both “qualifying public premises” and “qualifying public events” will be caught by the new law. 

1. Qualifying public premises

Qualifying public premises are premises above a stated capacity level, and primarily used for a purpose listed at Schedule 1 to the Bill. Schedule 1 is very comprehensive and includes shops, visitor attractions, entertainment venues, and places of worship.

There are two types of qualifying public premises, with larger premises having more onerous compliance obligations:

• Standard duty premises are those with a capacity of between 100 and 799 individuals.
• Enhanced duty premises are those with a capacity of over 800.
  
  

If a premises is caught then it is the person who has control of the premises in connection with their Schedule 1 use that will need to comply with the legislation. The definition of “persons” here includes individuals, companies and other incorporated entities. 

For example, if a landed estate is owned by a particular family, but the visitor attraction and events activities are run by a trading company, it will be the trading company that will need to comply with the legislation.

The premises has to be primarily used for one of these listed purposes (so occasional public uses will not be enough to put a location into the category of qualifying public premises). Instead, these sorts of premises that are occasionally used for large scale events may be caught under the qualifying public events regime (see below).

Note that there are some exceptions to the capacity thresholds. For places of worship, schools and nurseries, these premises will always be subject to the standard duty regime, even where their capacity would otherwise put them into the enhanced duty regime. 

It is possible to have qualifying public premises within other qualifying public premises.  An example given in the guidance is individual shops within a shopping centre. For museums and galleries, an obvious example would be cafes run by third party operators on their premises.

2. Qualifying public events

These are large-scale events, with a capacity of over 800, at premises that are not otherwise caught by the legislation as qualifying public premises.

Examples of these sorts of events include music festivals or country fairs on otherwise private land.

These events must be accessible by members of the public, who must be there by express permission only. The definition extends to free as well as paid-for events. 

If any event is caught by this definition, the obligations to comply with the legislation will be imposed on the person who has control of the premises in connection with the event. While it is possible for events to be jointly controlled by two or more persons, careful consideration may need to be needed when a third party is given permission to host an event on someone else’s property (for example, a promoter hosting a festival on private land) as to where the compliance burden lies. 

3. Assessing capacity

The precise meaning of “capacity” for the purpose of this legislation is still to be provided; draft regulations setting out more prescriptive methods of calculation will follow on this in due course. For most venues and events, it will be obvious which category the premises or event falls into for the purpose of complying with the legislation as most venues have a stated capacity levels for insurance purposes. Until we have anything more concrete, these capacity limits are probably a good indication of which regime (if any) will apply to a particular premises or event.     

Of course, owners of those premises or events at the fringes of these capacity bands will want to pay close attention to how capacity should be assessed to avoid incorrect labelling.  

Offices and private areas will be excluded from the scope of the capacity calculations (and the regime more generally).

Registration

A regulator will be tasked with the powers of inspection and enforcement. The identity of the regulator is still to be confirmed. It will either be the Home Office or a newly established regulator. 

Qualifying public premises will have to register with the regulator. The regulator must be notified of any qualifying events as soon as the details of the event are made public. 

In both instances certain prescribed information will need to be provided. Exactly what will be specified in further regulations. 

Duties

Certain duties are imposed on those in control of qualifying public premises and qualifying public events. While the exact substance of these duties is still unknown, the explanatory notes to the bill say the burden on standard duty premises is meant to be “low-cost”. The impact on enhanced duty premises and events will be more onerous. 

For what it is worth, the government has done its own calculations and expects to incur costs of £2,000 (defrayed over a 10-year period) in respect of each standard duty premises. The additional costs in respect of enhanced duty premises have been put at over £80,000. Costs faced by private operators may well be higher as the above costs to not anticipate increases in insurance premiums that may be payable by private operators following the introduction of the new law.

In broad terms, each of the below obligations need to be reviewed and updated at least annually, and whenever there is a “material change” to the premises or event that may have a bearing in the terrorism risk profile or risk mitigation procedures required. 

Standard duty premises

A standard terrorism evaluation must be completed and must include information such as:

• type of terrorism most likely to occur at the premises,
• terrorism prevention measures in place at premises,
• harm reduction measures, and
• procedures to be followed if a terrorist act occurred.
  
  

The government guidance suggests there will be a host of publicly-available information that can be used to complete these evaluations. 

Terrorism protection training must be provided to “relevant workers”. There is no requirement for these workers to be paid so volunteers could be within scope of this definition. A person is a “relevant worker” if they “have responsibilities that make it appropriate for them to receive terrorism protection training”, which is a fairly vague description, but hopefully the forthcoming guidance will provide additional clarity on who might be within scope. 

Enhanced duty premises and qualifying public events

For larger premises and events:

• a terrorism risk assessment must be produced,
• as with standard duty premises, terrorism protection training must be provided,
• a named individual must be appointed as the designated senior officer for the premises or event, and will be responsible for regularly reviewing and updating the terrorism risk assessment,
• all “reasonably practicable” measures that might be expected to reduce the risk of such an act occurring or the risk or scale of harm as a result must be implemented. The bill states that this obligation should not impose a “disproportionate burden” on the person in control of the premises or event (TBC what will be considered “disproportionate” in this context), and
• a security plan must be produced that pulls these various strands together. This must be provided to the regulator.
  
  

Co-operation notices

If a third party has an element of control over the premises or event and their co-operation is required to enable the person responsible for overall compliance to discharge their duties under the law, then this person responsible for overall compliance will be required to send a co-operation notice to the third party spelling how what is required from them. These requirements cannot be “disproportionate” – though again we wait to hear what that means in this context.

An obvious example of where a party might use a co-operation notice is where a premises owner allows a third party to use the premises for a particular event or purpose. While venue owners may be tempted to push the compliance burden on to this third party, it is clear that they cannot do this – and to the extent that they do want third party support, this comes with an administrative burden of producing a co-operation notice and sending it to the regulator.

Enforcement

This bill comes with teeth. The regulator can impose a range of civil sanctions to address non-compliance, as well as criminal offences for the most serious breaches.

Contravention notices can be issued by the regulator that set out the contravention and the steps that are required to remedy these. In serious cases – and in respect of enhanced duty premises and events only – a restriction notice may be issued, restricting the use of a particular premises for certain uses for a period of up to six months. 

Failure to comply with a contravention or restriction notice could result in fines. For enhanced duty premises and events, these could be the higher of £18m or 5 per cent of worldwide revenue. 

It is a criminal offence to fail to comply with a contravention notice or a restriction notice for enhanced duty premises and events. Where the offence has been committed by a body corporate, directors or other senior offices could be personally liable. 

Next steps

As will be clear from the above, a lot of the detail remains to be provided in the form of government guidance and further regulations. At this stage, organisations can prepare for the legislation coming into force by familiarising themselves with the concepts and requirements (https://www.protectuk.police.uk/ has a useful database of materials in that regard), and anticipating the additional costs and compliance burden required.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.

© Farrer & Co LLP, May 2023