A High Court judgment between Al-Najar and others v The Cumberland Hotel (London) Ltd in June 2019 has re-evaluated the duty of care requirements imposed on hotels in respect of criminal acts of third parties.

In this case, Mr Spence entered into the Cumberland Hotel to steal valuables from the claimants. During this act, he struck three of the claimants on the head with a hammer and, after leaving the hotel, subsequently withdrew GBP5,000 from their credit cards.

The old approach to determining whether a duty of care arises from a hotel to guests against criminal acts of third parties has been to apply a three stage test; was the damage foreseeable, was there a sufficiently proximate relationship between the parties and is it fair, just and reasonable to impose a duty of care?

It is of course understood that hotels owe a duty of care to their guests in respect of their safety, but until now, the scope of this duty covered undertakings over which the hotel exercised complete control. For example, slipping on a wet floor, food safety standards and other internal risks like fires. From a risk management perspective, this was achievable.

In the Cumberland Hotel case, the court extended the duty of care on hotels to being that it should "take reasonable care to protect guests at the hotel against injury caused by the criminal acts of third parties… [to include an] omission to take steps to prevent an attack". With this recent judgment, the burden that is now placed on hotels in relation to the scope of its duty of care has dramatically increased.

The implications of this cannot be understated. The judgment, in short, indicates that there has to be a likelihood that a particular risk (i.e. harm to guests by a third party) could occur for the duty to bite. This is extremely difficult to reconcile for industry duty holders to risk assess.

For those in the hotel industry, and perhaps the hospitality industry more broadly, the concern now is as to what methods duty holders should implement to cover this overly burdensome approach. The decision has the effect that, for example, having individual keys to hotel rooms is no longer sufficient to cover the duty of care.

The judge found on the particular facts that although the duty of care existed, there was no breach. For example, due to performance of such activities like consistent monitoring of CCTV and ensuring patrols were undertaken throughout the day, the hotel had fulfilled its duty to its guests.

However, it may be that for smaller, more remote hotels in similar circumstances, such a laborious approach would not be sustainable. In addition, how far does this duty of care expand into other businesses within the hospitality sector?

How can a high street coffee shop, for example, be expected to owe a duty of care to prevent a person in the street walking in and attacking one of the shop's customers?

It seems likely that this judgment will be subject to legal challenge as to its scope in the near future, and save such an occurrence, in the interim, there is an immediate requirement to review internal policies and procedures regarding customer safety.

Guidance on how to accord with the duty will inevitably need to be considered by all stakeholders and duty holders in the industry.