Written evidence submitted by the Home Office (TER0055)

Dear Dame Diana,
 

The Draft Terrorism (Protection of Premises) Bill
 

Following my appearance before the Committee on 20 June, I committed to write on several issues concerning the draft Terrorism (Protection of Premises) Bill. Please find my responses below, alongside some further clarificatory points which I hope will assist the Committee.

Firstly, you asked for written clarity on what is required in the legislation.

Martyn’s Law will ensure that people are prepared in the event of a terror attack, and are ready to respond. This will be achieved by placing a requirement on those responsible for certain premises and events to consider the threat from terrorism and implement appropriate and reasonably practicable mitigation measures.
 

The Bill’s proposals would apply to “qualifying public premises” which:

         are accessible to the public;

         are used primarily for a purpose listed in the Bill (e.g. for entertainment and leisure, retail, food and drink, museums and galleries, sports grounds, visitor attractions, places of worship, health, and education); and

         have a public capacity of 100 individuals or more.

The Bill establishes a tiered model. Standard duty premises mainly comprise those with a capacity of 100 to 799 individuals whilst enhanced duty premises comprise those with a capacity of 800 or more individuals. Qualifying public events are subject to similar requirements to the enhanced tier and have a public capacity of 800 individuals or more.

Clause 5 sets out who is the person responsible for qualifying public premises or events (see further below). This ‘responsible person’ is responsible for compliance with the requirements of the Bill.

Standard duty premises (capacity 100-799)

At standard duty premises, the responsible person will be required to:

1)     ensure the premises are registered with the regulator;

2)     ensure a Standard Terrorism Evaluation (STE) is completed (Clause 11). Following extensive engagement with a range of partners the Government published a draft of the STE template and accompanying draft guidance on 2 June[1]; and

3)     fulfil the training requirement in respect of relevant workers (Clauses 13 and 14 - see below for more detail).

The STE template and guidance are designed to direct and support non-expert audiences. It guides lay readers – in a clear and simple way – though a low burden evaluation of:

• the threat in the context of their premises;
• who may need information or training and how to deliver this; and
• who should do what in an attack.
   

The Bill does not require standard duty premises to purchase or install any additional physical security measures and we will consider whether further clarity can be provided in this respect. The intention in this tier is to drive good security outcomes, and these could be as simple as:

• Educating staff on door locking procedures;
• Providing terrorist awareness briefing and education to staff (which will be available for free on ProtectUK);
• Formulating, and educating all staff on, evacuation and invacuation procedures.

There will be easy to use guidance and products, such as security and CT awareness materials, which will support duty-holders to complete their evaluations.

In practice, we expect that at many standard duty premises an individual would complete the STE, and use this to disseminate information on what to do in the event of an attack by including this information as part of onboarding processes, displaying information in staff and public areas, emailing details, or including in contracts for hire of the premises where relevant (see Clause 11(1)(d) and 11(4)(e)). This would be in line with approaches already taken by such organisations to meet their obligations under Fire and Health and Safety legislation.

Enhanced duty premises and events (capacity 800+)

At enhanced duty premises and events, the responsible person will be required to:

1)     ensure the premises are registered with, or event notified to, the regulator;

2)     ensure a Designated Senior Officer is appointed for the premises or event;

3)     ensure a risk assessment and, subsequently, a security plan are completed and maintained (Clauses 12 and 17);

4)     ensure that all such reasonably practicable measures are in place in relation to the premises or event as might (together) be expected to reduce the risk of terrorist acts occurring, or physical harm resulting from an attack, at or immediately near the prevents or event (clause 15); and

5)     fulfil the training requirement in respect of relevant workers (Clauses 13 and 14 – see below for more detail).

These requirements reflect the proportionally higher risk to the public at enhanced tier locations and therefore require the responsible person to have a more comprehensive grasp of the threat.

As part of risk assessment and security plan processes, the responsible person will need to consider the implementation of reasonably practicable security measures, a standard utilised in other regulatory regimes (e.g. Health and Safety). This will enable organisations to consider their approach in light of the nature of the premises, their activities and their resources.

Whilst some enhanced duty premises may be required to install physical security measures, that will not be the case for all and, for many premises, more meaningful and impactful security enhancements may look like:

• Ensuring appropriate oversight from senior leadership;
• Appropriate staff training on protocols; and
• Adherence to access control procedures and search policies, as well as appropriate CCTV monitoring.

Guidance to help responsible persons to make these assessments is in development, and it will be supported by a range of products that will be available prior to commencement.

Training requirements and definition of ‘relevant worker’

During the evidence session the Committee asked about the training requirements in the Bill.

Clauses 13 and 14 establish a requirement for responsible persons for all qualifying public premises and events to ensure training is provided to those identified as relevant workers. It sets out that training for relevant workers in both tiers must be appropriate to the type of activities taking place at the premises and their specific circumstances, such as size and operating environment. It also specifies the types of training required, this being:

• understanding the acts of terrorism likely to occur;
• how to identify an attack might be taking place; and
• the procedures to follow in the event of an attack.

As such, currently all premises and events will have to tailor their approach to what is suitable and most effective for their circumstances. In many cases, the premises’ operating environment and location, and roles performed by individuals, may result in the responsible person determining that there are no relevant workers within the meaning of clause 13, particularly at standard duty premises, who must be provided formal training. In others circumstances, the responsible person may identify a number of workers fit the criteria due to their specific operating model, location and the responsibilities of certain individuals. Guidance, made available prior to commencement, will support responsible persons to make such assessments.

A ‘relevant worker’ is an individual who works at, or in connection with, the premises or event and has responsibilities that are appropriate to receive terrorism protection training. A relevant worker may be an employee, volunteer or contractor.

Under the current draft, relevant workers will be present at standard and enhanced duty premises and qualifying public events, but who they are and what levels of training they require will be dependent on the individual circumstances. These include what activities the worker undertakes and the responsibilities they have as part of their role, and the operating environment of the premises or event. On that basis, it is certain that not all workers will be relevant workers who must be provided with training, and guidance will be provided to assist in making this judgement within both tiers.

I am mindful that the current drafting of clauses 13 and 14 may not provide the level of direction and clarity required. As such, I have asked my officials to consider this further and I would welcome the Committee’s views in this respect.

During the session, the Committee enquired about the ‘responsible person’, sanctions and liability.

Responsibility for complying with the Bill’s requirements rests with the person responsible for qualifying public premises or a qualifying public event in accordance with Clause 5.

This is the person in control of qualifying public premises in connection with the main use under the Bill or in control of premises at which a qualifying public event is to be held in connection with that event. In the majority of cases, we expect that this person will be a business or other organisation with its own legal personality and not an individual. Nonetheless, in some circumstances, premises or an event may be run directly by an individual and so an individual could be responsible for compliance with the Bill’s requirements.

The intention of our proposals is that premises and events in scope take forward reasonable mitigations to terrorist threats. Whilst there are appropriate sanctions in place for non-compliance, we do not want to see responsible persons unfairly punished. As such we intend for the regulator to primarily rely on a civil regime rather than criminal sanctions to secure compliance. The regulator will be able to issue contravention notices and monetary penalties in relation to both tiers, albeit with restriction notices limited to enhanced duty premises and qualifying public events. It is the Government’s clear intention that, in the vast majority of instances, monetary penalties will be used primarily as a backstop for breach of a contravention or restriction notice. Also limited to enhanced duty premises and qualifying public events is the criminal offence for failing to comply with a contravention notice.

The penalty for the standard tier has been set at a maximum of £10,000 (compared to £18m or 5% of worldwide revenue at the enhanced tier). This is to ensure that an appropriate penalty can be issued to larger organisations within this tier, whilst ensuring smaller locations are not subject to a disproportionate fine. As such, the Bill requires any monetary penalty issued must be proportionate to the contravention, taking into account any action taken to remedy issues. Furthermore, the regulator must provide an opportunity to make representations regarding the proposed penalty and, of course, there is the right of appeal.

I should also clarify, as was previously discussed, that Clause 42 precludes civil liability under the Bill. This is intended to prevent the bringing of claims against organisations for breach of statutory duty in failing to fulfil the Bill’s requirements. It is the role of the regulator to address non-compliance.

Finally, during the session the Committee enquired about the treatment of events in the draft Bill

The Bill captures events for which the following conditions are met:

• the event is to be held at premises which are not qualifying public premises;
• the public or a section of the public will have access to the premises, or a part of the premises, for the purpose of attending the event, and that access must be by express permission; and
• the premises have a public capacity of 800 or more individuals.

The requirement for express permission is intended to ensure that the duties are imposed only where those responsible for events have sufficient control over entry to the site to consider and take forward requirements for the duration of the event.

As was outlined by Matt Jukes during his evidence session, there are existing processes in place whereby the security of large open events, operating without express permission, are considered.

I would like to again thank the Committee for taking the time to conduct pre-legislative scrutiny of the Bill. The feedback thus far has proved invaluable, and I look forward to receiving the Committee’s formal findings and recommendations. Collaboration with parliamentarians, businesses, voluntary organisations, and local authorities is the cornerstone of this process, and I am keen to work with you to further improve security and ensure robust, yet proportionate, measures are implemented at public premises, balancing the interests of business and organisations against the threat we face today.
 

Yours sincerely 

Rt Hon Tom Tugendhat MBE VR MP 

Security Minister 

July 2023