Martyn’s Law / the Protect Duty: new Bill published

The Terrorism (Protection of Premises) Bill was introduced into Parliament and had its first reading on 12 September 2024. The draft legislation marks a step towards the “Protect Duty”, also known as Martyn’s Law (after Martyn Hett, one of 22 people killed in the 2017 Manchester Arena attack).  The new duty aims to reduce the vulnerability of premises and limit the physical harm to individuals by requiring persons with control of premises to take certain preparatory and protective steps against terrorism threats. Figen Murray – Martyn Hett’s mother – has spent seven years campaigning for the introduction of this legislation.  Frustrated at the delay, she walked 200 miles from Manchester to Downing Street earlier this year, calling for the law to be enacted as soon as possible.

The new duty has already been subject to scrutiny. A draft bill was first published in May 2023, and was then then the subject of consultation during the winter of 2023.  As a result, amendments were made to make the impact of compliance more balanced and proportionate, particularly for smaller premises.

The Bill applies to certain premises in connection with their use (for example shops, nightclubs, schools, and premises hosting certain events) and divides those into Standard Duty and Enhanced Duty. The classification depends on their expected capacity - imposing greater obligations for those in control of the larger venues. A significant change which has been made since the public consultation is that the minimum capacity for Standard Duty premises is now 200+ rather than 100+, bringing more premises out of scope. The capacity for Enhanced Duty premises and events remains 800+.

Neither the Standard nor Enhanced Duty requirements include specified training or forms of risk evaluation/assessment (albeit taking such steps may be demonstrative of complying with the new requirements ). Instead, Standard Duty requires the implementation of “appropriate and reasonably practicable public protection procedures” that would be followed by workers and could reduce the risk of physical harm to individuals in the event of an attack. These will include getting people out of the building, keeping people safe inside, securing the premises against attackers, and providing safety information. 

Whereas Standard Duty requirements focus on staff preparedness and response, Enhanced Duty requirements may include physical changes to the premises by way of “appropriate and reasonably practicable public protection measures”. Such measures are those that might be expected to reduce vulnerability of the premises, and the risk of physical harm to individuals, of an act of terrorism. This may require, for example, the installation of locks and barriers or CCTV. A designated senior individual should be appointed to be responsible for ensuring compliance, and steps taken in accordance with this requirement must be documented, and said document provided to the regulator.

The “reasonably practicable” wording is also found in Health and Safety law and expected to be applied and interpreted similarly here: it requires consideration of risk against the sacrifice involved in the measures necessary to avert it. It has previously been made clear that those responsible need not do anything that is either outside of their control or a disproportionate burden on finance or resources, having regard to resources available. This is likely to mean that the expectation will be higher for businesses of considerable resource.

The new  bill also clarifies a number of points that were uncertain before. Reference to “public capacity” has been replaced with “reasonable expectation of number of individuals present”, which may be determined to existing calculations for, for instance, safe occupancy for fire safety purposes. We also now know that the regulator to which both Standard and Enhanced Duty premises should be notified is intended to be delivered as a new function of the Security Industry Authority  (the SIA), the regulator of the UK’s private security industry.

The regulator will have powers to inspect premises on notice or with a warrant to review compliance and may offer advice and guidance free of charge. Unlike food standards, there will be no public rating after the inspection. The regulator may enforce through a range of civil sanctions including notices requiring compliance or restricting (even closing) premises until suitable measures are in place, issuing penalty notices up to £10,000 for Standard Duty premises and £18m or 5% of worldwide revenue for Enhanced Duty premises or events. Failure to comply with a notice, and other acts or omissions that undermine civil sanctions, will be a criminal offence.

With tens of thousands of businesses likely to be subject to Enhanced Duty requirements, and each needing to register with the regulator (albeit the form of registration and the necessary documents are awaited), and hundreds of thousands within the Standard Duty and subject to regulation, SIA resources may be under considerable strain.

There is also, of course, the possibility that the law will change further before it is finalised. However, with consultation feedback taken on board and a desire to enact the law quickly, the legislative timetable for Martyn’s Law is expected to be swift, with detailed guidance to follow for those affected  and an implementation period of 18-24 months expected before the law comes into effect fully.