Skip to main content
Legal case

AI-Najar and others v The Cumberland Hotel (London) Limited

A hotel owner was not in breach of their duty of care

Executive summary

A hotel owner was not in breach of their duty of care for failing to prevent a theft and attack inflicted on their guests by a third party.

The facts

The Al-Najar family were staying at the Cumberland Hotel in 2014. In the early hours of the morning, Philip Spence walked into the hotel and gained access to one of the Al-Najar’s rooms, as a result of one of the family leaving their door ajar. He attacked several members of the family who tried to challenge him in the room, leaving one of them with a catastrophic brain injury for which Mr Spence was convicted and imprisoned for life.

The claimants brought a civil claim for damages against the defendant, contending that the hotel had failed to keep them and their property “reasonably safe”. Both sides adduced expert evidence in respect of security operations. It was confirmed in evidence that thefts at the hotel occurred, on average, once per week. All doors were fitted with locks, latch guards and viewing holes. Patrols were carried out a minimum of once every 24 hours, a frequency which increased post-accident. However, it also emerged in evidence that, prior to the relevant incident, the hotel’s security manager had recommended a card system to access the lifts. This had been rejected by management and only installed some time after the index accident, for unrelated reasons, although this did not appear to have reduced the number of thefts.  


Giving judgment, Mr Justice Dingemans found that, having invited guests to stay at the hotel, the defendant had assumed responsibility for them and therefore owed a duty to take reasonable care of those guests to protect them against injury caused by the criminal acts of third parties. Consequently, the occurrence of the very same criminal act could not be regarded as breaking the causal chain. He went on to say that it was reasonably foreseeable to the hotel that a third party may enter the hotel and injure a guest by way of criminal assault, such risk having been identified in training documentation albeit categorised as low risk.

Having determined that the defendant owed a duty of care, much of the judgment was taken up with determining whether the defendant had breached that duty. In this regard evidence of what systems other 4 star hotels operated was relevant albeit not determinative. Whilst the judge accepted some of the claimants’ submissions (the hotel had no overreaching security plan or single formal risk assessment, that on previous occasions a lobby officer had not been present at all times as required by the hotel’s policy, some CCTV cameras were inactive and there was no continuous monitoring of such cameras), he found there had been no breach of duty. In all the circumstances, in his opinion, the hotel took security seriously as a result of its security policies, training, detailed system for investigating incidents, monitoring security issues, having clear roles for security staff, and operating daily patrols.

By limiting hotel access to a single entrance after 11pm, employing a lobby officer and other staff, having CCTV coverage, self-locking bedroom doors and training housekeeping and other staff to challenge unfamiliar persons on guest floors, the hotel had taken reasonable care to protect its guests.

Given the low risk, in line with other hotels, there was no requirement to continuously monitor the CCTV, have cameras in lifts or on fire escapes, formally patrol more than once per day, install alarms on bedroom doors or implement key card access to lifts. Indeed the judge acknowledged that some of these measures could give rise to other impracticalities or be ineffective in any event. In the judge’s opinion, the need to keep bedroom doors locked was obvious and therefore there was no duty to remind guests to do so. Similarly, there was no requirement to have lobby staff greet every guest entering the hotel, particularly as such staff had the whole lobby to administer.

In Mr Justice Dingeman’s opinion, more frequent patrols and more lobby staff would not have prevented the attack on the balance of probabilities, and whilst door alarms, or a requirement to greet every visitor would have prevented the attack, he conceded that “the reality is that in most cases it will always be possible to identify something which would probably have prevented an attack, such as security arches….. although it was not contended that the duty to act reasonably extended to requiring the erection of such”. In such circumstances, the defendants had done enough to constitute reasonable care and the claimants’ claims failed.


Clearly this was a tragic case for the claimants. Given some of the gaps in process or procedure by the hotel, as well as the changes implemented post-incident, and the finding that some relatively simple measures could have prevented the attack, the decision was perhaps not a foregone conclusion. However the pragmatic and realistic judgment is a welcome one for hotel operators and their insurers in re-asserting that the duty of care is not an absolute one. The “unpredictability of criminal behaviour” implies that, if so minded, a criminal could circumvent whatever procedures were put in place to deter criminals and hence there is only so much a hotel could or should do. Arguably stringent security measures or limiting access to guests would be contrary to the welcoming ambience of a hotel in any event. Highlighting the obvious nature of the risk in leaving bedroom doors ajar, suggesting the onus on personal responsibility to keep doors locked, is to be welcomed as far as the hospitality sector, and those who insure hotels, are concerned.

If you have any questions or would like to know more about our legal update, please contact Peter Forshaw, Partner, on 0151 242 7935, or email

Sectors and Services featured in this article