Following the Government consultation which ran in 2021, the draft Terrorism (Protection of Premises) Bill has now been published for the Committee to conduct pre-legislative scrutiny.

Aim of the new legislation

There have been an increasing number of terrorist attacks in public spaces in the UK – most notably, the Manchester Arena bombing. Currently, there is no legislative requirement for the vast majority of organisations to consider or employ security measures to help prevent such incidents occurring. The devastation caused by the Manchester Arena bombing has provided impetus for much needed legislative change.

The new UK wide legislation aims to enhance national security by introducing new security requirements for those in control of qualifying public premises and events to take reasonably practicable measures to ensure preparedness for and protection from terrorist attacks.

The new framework requires those in control of qualifying public premises and events to consider the threat from terrorism and implement appropriate and proportionate mitigation measures, depending primarily on their public capacity.

Importantly, this includes extensive ‘enhanced duties’ for qualifying public premises and events with a public capacity of 800 or more people.

The new legislation will introduce a comprehensive inspection and enforcement regime, with potentially severe sanctions for larger organisations and the senior individuals who run them, for the most serious breaches.

Who and what will the terrorism protection requirements apply to?

What?

The new legislation applies to qualifying public premises and qualifying public events.

Qualifying public premises are premises with specified uses and a public capacity of 100 people or more. The list of specified uses is broad and includes: shops, nightclubs, entertainment activities, sports grounds, recreation, exercise or leisure, libraries, museums, galleries, exhibition halls, visitor attractions, hotels, places of worship, hospitals, the provision of healthcare, childcare, education, public authorities and parts of transport hubs to which a transport security regime does not already apply. Notably, this does not include offices.

Qualifying public premises with a public capacity of 800 or more people are subject to enhanced duties and are known as enhanced duty premises. All other qualifying public premises are subject to standard duties and are known as standard duty premises.

Qualifying public events are events which are held in non-qualifying public premises that have a public capacity of 800 people or more.

Who?

The person(s) with responsibility for compliance with the new requirements will be the organisation or organisations who have control of the qualifying public premises or qualifying public event.

The draft Bill also makes provision for the responsible person to give another organisation, who to some extent has control, a cooperation notice, specifying the steps that they reasonably require them to take in order to comply with the requirements of the legislation.

What will the new legislation require from organisations and their senior officers?

Standard duties

Organisations responsible for standard duty premises will be required to undertake (and keep up to date) a standard terrorism evaluation and provide terrorism protection training to relevant workers. The draft Bill prescribes the matters which must be covered in the standard terrorism evaluation to include: the type of terrorism most likely to occur; measures to reduce the risk of acts of terrorism; measures to reduce the risk of physical harm; and procedures to be followed in the event of a terrorist attack. The Government anticipates this will require only low cost activities, such as reliance on Government free terrorism protection training.

Enhanced duties

Organisations responsible for enhanced duty premises and qualifying public events will have enhanced duties, which are prescribed in some detail over several sections of the draft Bill (and are expected to be supplemented by Regulations and Guidance). The enhanced duty will include: terrorism protection training for relevant workers; appointment of a designated senior officer (DSO); preparation and renewal of a terrorism risk assessment; the implementation of all reasonably practicable security measures and the preparation and renewal of a security plan (which must also be provided to the regulator).

DSO’s

The DSO must be a director, manager, secretary (or other similar officer) of the responsible organisation and must have responsibilities for coordination of the risk assessment; coordination, preparation and maintenance of the security plan; and coordination of the response to any notice or other communication from the regulator.

Registration framework

The new legislation also introduces a framework for registration of qualifying public premises and notification of qualifying public events to the regulator.

Regulator’s powers and consequences of non-compliance

Inspection and investigatory powers

The regulator will be equipped with a suite of powers including information gathering, entry and inspection (set out in Schedule 2 of the draft Bill) which are intended to ensure that investigations into compliance at qualifying public premises and qualifying public events can take place.

Notices

The regulator will have the power under certain circumstances to serve contravention notices requiring compliance with relevant requirements and restriction notices restricting the use of the specified premises.

Civil penalties

The regulator will be able to issue civil monetary penalties where they are satisfied, on the balance of probabilities, that there is or has been a contravention of a relevant requirement. In many cases, it is expected that these will be issued following a failure to comply with a contravention or restriction notice. For standard duty premises, the regulator will have the power to issue a fixed penalty up to a maximum of GBP10,000. However for enhanced duty premises and qualifying public events, the regulator will be able to issue a maximum fixed penalty of the higher of GBP18 million or 5% of worldwide revenue.

Criminal offences

In addition to potentially severe civil penalties, the new legislation will introduce criminal offences in respect to certain failures or misconduct, including the failure to comply with a restriction notice or contravention notice relating to an enhanced duty premises or restriction notice.

Where an offence has been committed with the consent or connivance of a director, manager, secretary or other similar officer or is due to neglect on the part that person, that person is guilty of the offence as well as the company. Such an offence carries a maximum 2 years imprisonment and/or unlimited fine.

Whilst regulators tend to take enforcement action against organisations rather than individuals, it is arguable that under this new regime, DSO’s will have particular exposure to individual enforcement and even prosecution. It is therefore critical that enhanced duty holders ensure that their DSO’s are (and continue to remain) sufficiently competent, have the necessary resource to undertake this role successfully and regularly report to the board on compliance matters.

What happens next?

Pre-legislative scrutiny will now take place and will be an opportunity to refine the legislation. The Security Minister will work to address the issues raised over the coming months and resubmit a revised impact assessment ahead of formal introduction.

We are anticipating Regulations and Government guidance to follow which should provide more clarity on what is expected of duty holders, including how public capacity should be calculated and further details on the regulator and its functions. Guidance is set to be “clear and detailed”, “sector-specific” as appropriate and is expected to highlight dedicated points of contact for duty holders.

What should responsible organisations be doing now?

All organisations who are likely to have duties under this new legislation should consider how the new legislation will impact their business (including their dealings with third parties who will have similar or overlapping duties).

Steps should be taken now to reassess the threat from terrorism, retrain staff and implement any additional appropriate security measures relative to an organisation’s likely status as either a standard or enhanced duty holder.

In particular, enhanced duty holders should take steps now to prepare for the appointment of a DSO, ensuring that the appointed individual has sufficient competency (including up to date training, qualifications and experience in the security industry and anti-terrorism) and available resource. The appointment of a competent DSO is likely to be the key to unlocking compliance for enhanced duty holders.

DLA Piper has a dedicated team of regulatory lawyers who were instructed by a central Core Participant in the Manchester Arena Inquiry – from which the Protect Duty has evolved. Our team has a unique insight into the development and enactment of the Protect Duty. Should you have any queries arising out of this article, please contact the authors or your regular DLA Piper contact.