Georgia’s Tort Reform Law (SB 68) Grants Significant New Protections to Property Owners From Runaway Premises Liability Claims

Footnotes for this article are available at the end of this page.

After two consecutive years ranking as the number one “judicial hellhole” in the country — followed by only a slight improvement to number four — Georgia’s General Assembly, with the leadership of Governor Kemp, passed sweeping tort reform legislation to help improve not only these ignominious rankings but also the underlying litigation crisis. Governor Kemp signed Senate Bill 68 into law on April 21, 2025, clarifying the circumstances under which a property owner may be held liable for harms caused by third parties that occur on the owner’s or occupier’s property. Property owners have plenty to pay attention to in this legislation, including concepts of “negligent security,” foreseeability of the harm, whether the injured party is an invitee or licensee, and liability of security contractors on the premises.

Can a property owner be held liable for criminal actions or misconduct of a third party on the owner’s property? Unfortunately, the answer has been “yes,” resulting in several “nuclear verdicts” (jury verdicts awarding over $10 million). In CVS Pharmacy v. James Carmichael, for example, a plaintiff was shot in a CVS parking lot by a third party not associated with CVS. The Supreme Court of Georgia affirmed in its June 2023 opinion that a jury could reasonably find that the harm to the plaintiff was a “probable and natural consequence” of CVS’ failure to implement “adequate security measures” to protect the property and the parking lot. The jury assessed 95% of the liability against CVS, and no reduction in damages was available to CVS.¹

To level the playing field against these runaway verdicts, SB 68 offers several new protections against “negligent security” actions, limiting the instances in which a property owner or occupier may be liable for damages due to harms caused by a third party’s actions on the property.

A negligent security claim is any claim against a property owner or occupier, or against a security contractor, that arises from such owner’s, occupier’s, or security contractor’s failure to keep the premises and approaches to the premises safe from wrongful conduct of third parties. “Third parties” refers to any person other than an owner, occupier, or security contractor. Note that an on-duty employee of an owner or occupier would not necessarily be considered a “third person,” unless perhaps that employee acted intentionally, outside of their employment, or was otherwise engaging in behavior outside of their employment — even if during working hours.

If a person on the premises in question is harmed by the misconduct of a third party, two initial questions may be posed:

1. Is the injured party an invitee or licensee? A property owner owes a lower duty of care to a licensee than to an invitee; and
2. Does the incident fall within the list of situations in which the property owner/occupier cannot be liable for negligent security? See Section II below.

I. SB 68 Premises Liability: Invitee or Licensee?

Invitee: An invitee, such as a bona fide customer, enters the property upon the express or implied invitation, including to do business with the property owner or occupier. In contrast, a licensee is on the property for its own reasons or convenience unrelated to the property owner/occupier’s use of the property, for example someone meeting in a parking lot to complete a Craigslist sale.²

If the injured party is an invitee (a customer) under SB 68, an owner or occupier can now be liable for negligent security only if plaintiff proves all of the following:

1. Foreseeability of wrongful conduct: The injury was caused by a third party’s wrongful act, and the owner or occupier:
   • had “particularized warning” of an imminent threat; or
   • should have known, based on clear and convincing evidence, that such conduct was reasonably likely, given prior substantially similar incidents on the premises or in the surrounding area (within 500 yards).
2. Foreseeability of injury: The harm sustained by the invitee was a reasonably foreseeable consequence of the third party’s wrongful conduct.
3. Premises vulnerability: The third party exploited a specific physical condition of the premises that created a security risk substantially greater than the general crime risk in the vicinity.
4. Failure to exercise ordinary care: The owner or occupier failed to mitigate or remedy the known security vulnerability and did not take reasonable steps to ensure the premises’ safety.
5. Causal link to injury: The owner’s failure to act was a proximate cause of the invitee’s injury.

“Particularized warning” in SB 68 imputes a high standard of knowledge, defined as “information actually known to an owner or occupier and deemed credible by the owner or occupier, which causes the owner or occupier to consciously understand that a third person is likely to imminently engage in wrongful conduct on the premises that poses a clear danger to the safety of persons upon the premises, such information being specific as to the identity of the third person, the nature and character of the wrongful conduct, the degree of dangerousness of the wrongful conduct, and the location, time, and circumstances of the wrongful conduct.”

With respect to invitees, if an owner or occupier neglects foreseeable risks and does not maintain a reasonably secure environment, they may be held liable for injuries resulting from criminal acts on their premises or the approaches to their premises.

SB 68 calls for property owners/occupiers to maintain situational awareness of their premises, although owners/occupiers are not expected to maintain their properties as fortresses to avoid legal liability for the misconduct of third parties on their premises. Consider the following questions:

• Have security incidents occurred on or within 500 yards of the premises, such as within a shared parking lot or on a neighboring parcel?
• Are physical security vulnerabilities apparent from a tour of the premises, such as a hole in a fence, or lighting is broken or not installed? The concern is physical vulnerabilities that could create a security risk that is substantially greater than the local crime risk.
• If specific physical security risks are identified, have steps been taken to address them?

Note that the “particularized warning” in SB 68 is a subjective standard for the owner or occupier of whether they personally deem a threat of wrongful conduct to be “imminent.”  Thus, property owners and managers will want to train their staff to avoid overreporting issues and, more importantly, reaching conclusions about potential situations in any logs or reports.  For example, a security guard should document only the facts observed, such as “observed vehicles loitering in parking lot,” rather than drawing additional and unsubstantiated conclusions that could increase liability concerns for the property owner, such as “observed vehicles loitering in parking lot that appear to be staging for an assault on customers.” For those who remember Hawaii Five-O, reports should contain “just the facts” without additional colloquy or speculation. And, as we will discuss below, property owners should train their staff call 911 to report observations, again just relaying the facts, because the new legislation grants immunity to owners who report issues to law enforcement.

Licensee: An owner or occupier is liable to licensees (again, someone who is on the property for that person’s own business, such as a Craigslist transaction) for negligent security under SB 68 only if the plaintiff proves:

1. Foreseeability of wrongful conduct: The injury was caused by a third party, and the owner or occupier had “particularized warning” of imminent danger (again a subjective standard for the property owner). Importantly, unlike the standard applicable to invitees, liability may not be imposed for injury to a licensee merely because a property owner/occupier “should have known” of the danger.
2. Foreseeability of injury: The harm sustained by the licensee was a reasonably foreseeable consequence of the third party’s wrongful conduct.
3. Premises vulnerability: The third party exploited a specific physical condition of the property that made crime more likely there than in the surrounding area.
4. Willful and wanton failure to exercise care: The owner or occupier deliberately failed to take any reasonable steps to fix or improve the known security vulnerability.
5. Causal link to injury: The owner’s failure to act was a proximate cause of the licensee’s injury.

Thus, the standard for holding a property owner/occupier liable for harm to a licensee is more favorable to owners/occupiers than the standard for imposing liability for harm to an invitee. If an owner/occupier knows of specific security risks and deliberately does nothing, and that specific known security risk caused the harm to the licensee, then such owner/occupier may be held responsible for injuries caused by misconduct by a third party. In contrast, with respect to invitees, an owner/occupier need not deliberately fail to act; rather, liability may be imposed if the owner/occupier failed to exercise reasonable care.

Sidebar – Affirmative security actions and foreseeability: If an owner/occupier hires a security guard or takes other affirmative steps to secure its property, could such actions be considered an admission that harms are foreseeable? Looking at the higher standard of care owed to invitees, a property owner/occupier is required to take reasonable steps to ensure the safety of the premises. A property owner/occupier should consider maintaining a record of the information gathered about area security risks (or lack thereof) and the actions such owner/occupier is taking to address any such risks. Affirmative security enhancement actions, such as hiring security guards or adding lighting, cameras, or other security features, could help support a defense against premises liability by demonstrating positive steps on the part of the property owner/occupier to uphold its duty of care.

In any lawsuit asserting a negligent security claim, the law states that, “in assessing whether an owner or occupier has breached a duty to exercise ordinary care to keep persons on or around any premises safe from wrongful conduct by a third person, the trier of fact shall consider the security measures employed by the owner or occupier at the time of the injury from which the claim of negligent security arises, the need for additional or other security measures, the practicality of additional or other security measures, whether additional or other security measures would have prevented the injury, the respective responsibilities of owners or occupiers with respect to the premises and government with respect to law enforcement and public safety, and any other relevant circumstances.”³

II. Outer Limits

Under the following exceptions outlined in SB 68, property owners/occupiers cannot be held liable under SB 68 for situations beyond such owner/occupier’s control, including for injuries or harm to persons on the owner/occupier’s premises arising from:

1. Trespassers: If the injured person was unlawfully on the property.
2. Off-premises injuries: If the injury happened outside the owner’s property.
3. Third-party conduct outside the owner’s control: If the wrongful act did not happen on the premises or in an area where the owner had the authority to remove the offender.
4. Tenant-related incidents: If a tenant or their guest caused the injury and eviction proceedings had already begun.
5. Criminal activity by invitees or licensees: If the injured person was committing a felony or certain misdemeanors at the time.
6. Single-family residences: If the injury occurred on premises used for a single-family residence.
7. Warning to law enforcement: If the owner had particularized warning of imminent danger from a third party, such as reports of a person casing the property or engaging in threatening behavior, but made a reasonable effort (such as calling 911) to report it.

The law clarifies that property owners/occupiers are not expected to “exercise extraordinary care” to keep persons on or around their premises safe from misconduct by a third party, nor to take on law enforcement duties. As referenced earlier, the legislation allows owners and occupiers to shift their burdens (and thus potential exposure) to law enforcement by reporting issues on the property. The statute grants absolute immunity to owners and occupiers for third-party dangers if the owner/occupier has reported those potential dangers to law enforcement (e.g., by calling 911).  Thus, owners, lessors, and managers should consider training their staff and security to liberally report all suspicious activities to law enforcement, albeit (again) without drawing any conclusions and instead only relaying the facts.

III. Security Contractor: Limits of Liability

Contracting with a security provider does not automatically shield an owner/occupier from damages, although retaining such security provider could help demonstrate the property owner’s/occupier’s effort to keep its premises safe to the extent required by the applicable standard of care. If a security contractor assumes and undertakes a duty to invitees and licensees to keep all or part of a premises of an owner or occupier safe from the wrongful conduct of any third person, the security contractor may be liable for negligent security only to the extent an owner or occupier would be liable under SB 68. Put another way, a security contractor shall not be liable for negligent security to an extent greater than the liability for negligent security of an owner or occupier. In the event a security contractor breaches its contract with the property owner/occupier, SB 68 does not limit the owner/occupier’s ability to pursue the security contractor for breach of contract.

IV. Allocation of Damages in a Negligent Security Action: Consider All Contributing Parties

SB 68 specifies that, if the defendant is found liable under negligent security, the trier of fact shall reasonably apportion fault among:

• the owner/occupier,
• any third person whose wrongful conduct was a cause of the injury at issue; and
• any other persons to whom fault otherwise should be apportioned under other sections of the Official Code of Georgia Annotated.

Last Words

The standard for imposing liability for third-party misconduct on commercial real property in the state of Georgia is now much higher than before. However, owners and occupiers of commercial real property in the state will benefit from reviewing the elements of “particularized knowledge” and the frameworks for liability for invitees and licensees, as well as the exclusions for negligent security liability. Questions, or a specific scenario to think through? Please contact AGG Litigation partners Knox Withers, Jason Bring, or a member of the firm’s Litigation & Dispute Resolution practice.

 

[1] Ga. CVS Pharm., LLC v. Carmichael, 316 Ga. 718 (2023).

[2] Cobb v. First Nat’l Bank, 58 Ga. App. 160 (1938); O.C.G.A. § 51-3-1

[3] SB 68, 51-3-55(b).