Opinion
No. W2008-01409-COA-R3-CV.
APRIL 21, 2009 Session.
Filed on July 30, 2009.
Direct Appeal from the Circuit Court for Madison County; No. C-04-504; Roy Morgan, Judge.
Judgment of the Circuit Court Reversed and Remanded.
David W. Camp, Jackson, TN, for Appellants.
Sean Antone Hunt, Memphis, TN, for Appellee.
Alan E. Highers, P.J., W.S., delivered the opinion of the court, in which Holly M. Kirby, J., and J. Steven Stafford, J., joined.
OPINION
After being abducted from a mall parking lot, the plaintiff filed suit against the security company that provided security services to the mall. The trial court granted summary judgment to the security company, concluding that only the premises owner, i.e., the mall, owed a duty of care to the plaintiff. Plaintiff appeals. We reverse and remand for further proceedings.
I. FACTS PROCEDURAL HISTORY
Sixty-five year-old Maggie Barron was employed as a customer service supervisor by CBL Associates Management, Inc., d/b/a Old Hickory Mall, in Jackson, Tennessee. On Saturday, May 8, 2004, at approximately 2:00 p.m., Mrs. Barron was leaving the mall when she was abducted by two juveniles in the mall parking lot and forced into the back seat of her vehicle. The juveniles took control of Mrs. Barron's vehicle and drove it around for several hours, while assaulting Mrs. Barron and threatening to rape and kill her. The juveniles ultimately wrecked Mrs. Barron's vehicle and fled.
Mrs. Barron and her husband filed this lawsuit against the two juveniles, CBL Associates Management, Inc., and Emerson Russell Maintenance Company ("ERMC"). Mrs. Barron alleged that ERMC "was responsible for providing security and protection to the general public and employees of [the mall]," and that ERMC "had a duty to protect the general public and employees of [the mall]." Mrs. Barron alleged that ERMC was negligent in failing to properly supervise activities at the mall; failing to warn of the dangers at the mall; failing to protect Mrs. Barron from injury; and failing to provide sufficient security so as to protect the safety and welfare of Mrs. Barron.
Specifically, Mrs. Barron and her husband named as defendants Emerson Russell Maintenance Company d/b/a ERMC, d/b/a ERMC II, L.P., d/b/a ERMC L.P.; ERMC of America, LLC; ERMC IV, L.P.; and ERMC V, L.P. We will refer to these defendants collectively as "ERMC."
The only issues presented on appeal involve Mrs. Barron's claims against ERMC. Mrs. Barron voluntarily nonsuited her claims against CBL Associates Management, Inc. ("CBL") after CBL filed a motion to dismiss asserting that Mrs. Barron's exclusive remedy against it was pursuant to the Tennessee Workers Compensation Act. The claims against the two juveniles were still pending when the order resolving the claims against ERMC was entered and made final pursuant to Tennessee Rule of Civil Procedure 54.02.
ERMC filed an answer alleging, among other things, that the attack by the two juveniles was not foreseeable. ERMC subsequently filed a motion for summary judgment claiming that it had no duty to protect Mrs. Barron from the unforeseeable criminal acts of the two juveniles, but in any event, ERMC argued, the security measures it implemented were reasonable. In support of its motion for summary judgment, ERMC submitted the affidavit of Jeff Smith, ERMC's Director of Mall Security, who stated that on the date of the attack, ERMC had two uniformed, unarmed security guards patrolling the interior of the mall and one mobile security unit patrolling the parking lot. In addition, ERMC offered an "escort" program whereby any mall employee could request a security escort to his or her vehicle, but Mrs. Barron did not use the escort program on the day of her attack.
ERMC also submitted the affidavit of Ben Beard, the security guard who was patrolling the parking lot in the mobile security unit on the day of the attack. Mr. Beard was a certified security guard and had been working as a security guard at the mall for 19 years. He stated that on the day in question, he did not see any suspicious activity in the parking lot around the time of the abduction.
ERMC also submitted the "incident reports" it maintained regarding crime at the mall. No one had ever been carjacked, kidnapped, or raped at the mall. According to the incident reports, during the twelve months preceding the attack on Mrs. Barron, there were various crimes at the mall, ranging in severity, including but not limited to six simple assaults, two aggravated assaults, one verbal assault, two incidents of disorderly conduct, one incident of threatening harassment, one incident of indecent exposure, one incident of drug possession, one robbery, two aggravated robberies, one purse snatching, thirteen burglaries from vehicles, two stolen vehicles, five thefts of motor vehicle parts, eleven incidents of vandalism, and one incident involving unlawful possession of a weapon. The incident reports from the previous twelve months revealed similar crimes.
ERMC also offered the expert affidavit of William Booth, the CEO of a security consulting and investigating firm, who stated that Old Hickory Mall had a "very low level of crime for a mall this size," which, in his opinion, "confirm[ed] the effectiveness of the mall security program." Mr. Booth opined that the number of officers patrolling the mall on the date of the attack was reasonable, considering the day, time, and size of the mall, and in fact, he stated that the "guard force" level at the mall was equal to that used in many other larger malls with much more crime.
In opposition to ERMC's motion for summary judgment, Mrs. Barron argued that her attack was foreseeable due to the number of prior criminal incidents occurring at the mall. Mrs. Barron submitted records from the Jackson Police Department listing crimes occurring at the mall during the four-year period prior to her attack, which included eleven robberies, three purse-snatching incidents, four pocket-picking incidents, fifty-four larcenies from vehicles, forty-nine larcenies of vehicle parts, thirty-three auto thefts, sixteen drug-related incidents, seven aggravated assaults, fifty simple assaults, and five weapons incidents.
Mrs. Barron submitted her own affidavit stating that "[she] did not feel that ERMC was providing adequate security at the Old Hickory Mall during the months leading up to May 2004." She explained that ERMC was not fully enforcing the mall's no loitering policy, which resulted in a large number of individuals loitering at the mall and a significant number of fights breaking out. According to Mrs. Barron, the "lack of security" was discussed at nearly every one of the mall's regular merchants' meetings, with store managers voicing their concerns about the fights and lack of security. Mrs. Barron also submitted the affidavits of two store managers, who stated that there was a problem at the mall with "kids" loitering and causing disturbances, including fights. Both managers stated that, in their opinion, ERMC was not providing "adequate security" at the mall in the months leading up to Mrs. Barron's attack.
The record before us does not contain any information about the mall's "no loitering" policy. ERMC's Security Policy and Procedure Manual is included in the record, and it states that it applies to "the duties common to all security organizations regardless of the site location." Regarding loitering, the Manual reads:
LOITERING in SHOPPING CENTERS
Loitering is defined as remaining in an area for no particular purpose — to hang out. Centers often attract individuals who loiter and yet do not create disturbances.
No one should be asked to leave unless he/she is creating a disturbance.
A disturbance is any activity, which interferes with the operation of the center and/or causes customers to leave the center. Individuals engaged in such activity should be asked to stop the offending behavior; individuals who refuse to stop their behavior should be asked to leave the center.
The security officer should call law enforcement officers to remove an individual from the center if the individual fails to stop the offending behavior and/or refuses to leave when asked to do so.
Individuals quietly enjoying the ambience of the property should not be asked to leave regardless of the duration of the stay.
Mrs. Barron claimed that ERMC failed to provide adequate security because there was only one mobile security unit on patrol on the day of her attack. Mrs. Barron conceded that ERMC "did not have notice of the two specific individuals who attacked [her]," but she claimed that ERMC did have knowledge that unruly groups of young people were congregating at the mall on weekends. Mrs. Barron claimed that if an extra security guard had been patrolling the parking lot, he might have seen the juveniles driving away in her car, or his presence may have deterred the juveniles from attacking her in the first place. She stated during her deposition that "on a normal day," she thought that ERMC utilized two mobile security units in the parking lots. Mrs. Barron claimed that ERMC could use two mobile security units at their discretion, and that the second mobile unit should have been used on the day of her attack because the mall was very busy due to a children's event being held at the mall and the fact that it was a Saturday. Mrs. Barron said that she would have expected ERMC to utilize at least two, but possibly even four mobile security units on such a busy day. Mrs. Barron was asked if she knew who made the decision regarding the level of security at the mall, and she said that although she did not know, she thought that it was ERMC's security director, Jeff Smith.
When asked during her deposition what she thought was "wrong with the security at the mall," Mrs. Barron stated, "I just don't think we had enough." When asked if anything else about the security was inadequate or faulty, she said no, and that the security officers ERMC did have were very good. In her response to ERMC's motion for summary judgment, however, Mrs. Barron alleged that the employee escort service was ineffective because employees had to wait a long time for assistance, and the guards were rude and too old.
ERMC then filed a reply to Mrs. Barron's response to the motion for summary judgment, presenting an alternative argument to the effect that it owed no duty to Mrs. Barron under any circumstance because it was not the owner of the premises where Mrs. Barron was injured. ERMC also claimed that if Mrs. Barron's only argument was that it should have provided "more security," then it should be granted summary judgment because the owner of the premises had the duty to determine the amount of security provided, not ERMC. ERMC claimed that Mrs. Barron had failed to explain how it could increase the level of security "beyond that which was dictated and requested by the premises owner." However, ERMC did not submit any evidence of its own indicating that it was bound to provide only a certain number of mobile security units.
On February 11, 2008, the trial court entered an order granting ERMC summary judgment, based on the following findings:
The court finds that under the prevailing case law, defendants, ERMC, do not have the duty of the owner to provide security or reasonable security measures, instead those duties fall clearly to the premises owner as set forth in the case of McClung v. Delta Square Ltd., 937 S.W.2d 891 (Tenn. 1996). The court further finds that the plaintiff has not allege[d] any negligence of defendants, ERMC, in providing the security that they provided. Instead, the plaintiff has only alleged, based upon the record before the court, that the defendants, ERMC, did not provide enough security and should have provided additional security measures. That duty, the court finds, under the case law, clearly falls to the owner, i.e., the mall.
The court's order also incorporated by reference the transcript of its ruling from the bench, where the judge stated that
ERMC was operating under contract, contract which is not disputed under the facts today, that coverage would be provided for security as required by the owner, owner being CBL, the mall. . . .
. . . .
. . . The issue that's been raised by the plaintiff was how much security was provided. They say it was inadequate. And that, again, falls on the mall, the business.
Mrs. Barron filed a motion to alter or amend, arguing that ERMC owed a duty to her pursuant to the Restatement (Second) of Torts section 324A, due to the fact that ERMC had undertaken, for consideration, the mall's duty to provide security. In response, ERMC maintained that no one but the business owner is under a duty to provide security. The trial court denied Mrs. Barron's motion to alter or amend, and Mrs. Barron timely filed a notice of appeal.
II. ISSUES PRESENTED
Mrs. Barron presents the following issue, slightly restated, for review:
Whether the trial court erred in granting summary judgment to ERMC based on the court's finding that ERMC owed no duty to Mrs. Barron.
On appeal, ERMC states the issue as follows:
Whether the trial court properly granted the Defendant's Motion for Summary Judgment where the plaintiff alleged only that the defendant did not provide adequate security and where Tennessee law provides that only the owner of the premises has a duty to provide security services for the protection of a party plaintiff against the criminal acts of a third party.
For the following reasons, we reverse the decision of the circuit court and remand for further proceedings.
III. STANDARD OF REVIEW
The resolution of a motion for summary judgment is a matter of law, which we review de novo with no presumption of correctness. Martin v. Norfolk S. Ry. Co. , 271 S.W.3d 76, 84 (Tenn. 2008). However, "we are required to review the evidence in the light most favorable to the nonmoving party and to draw all reasonable inferences favoring the nonmoving party." Id. (citing Staples v. CBL Assocs., Inc., 15 S.W.3d 83, 89 (Tenn. 2000)).
In order to establish negligence, a plaintiff must prove, among other things, "a duty of care owed by defendant to plaintiff." McClung v. Delta Square Ltd. P'ship , 937 S.W.2d 891, 894 (Tenn. 1996). Determining the duty that the defendant owed to the plaintiff is a question of law to be determined by the court. Id. (citing Pittman v. Upjohn Co., 890 S.W.2d 425, 428 (Tenn. 1994); Bradshaw v. Daniel, 854 S.W.2d 865, 869 (Tenn. 1993)).
IV. DISCUSSION
Before addressing the parties' specific arguments regarding the existence of a duty, it would be helpful to review the Tennessee Supreme Court's decision in McClung . In McClung , a customer was abducted from a shopping center parking lot and later raped and murdered. Id. at 893. The customer's husband filed suit against the owner and operator of the shopping center and against Wal-Mart, one of the stores in the shopping center, alleging that they were negligent in failing to provide security measures for the parking lot. Id. at 894.
A duty of care is "the legal obligation owed by defendant to plaintiff to conform to a reasonable person standard of care for protection against unreasonable risks of harm." McClung , 937 S.W.2d at 894 (citing McCall v. Wilder, 913 S.W.2d 150, 153 (Tenn. 1995)). The Court explained that the common law imposed no duty on anyone, except the government, to protect others from criminal acts of unknown third persons, although merchants did have a duty to exercise reasonable care to maintain their premises in a reasonably safe condition. Id. at 895. In 1975, the Supreme Court had held that businesses not attracting or providing a favorable environment for crime had no duty to protect customers unless (1) the business knew or had reason to know that criminal acts were occurring or about to occur on the premises, which (2) posed an imminent probability of harm to a customer. Id. at 896 (citing Cornpropst v. Sloan, 528 S.W.2d 188, 198 (Tenn. 1975)). Under that analysis, crime or conditions in the area of the defendant business were irrelevant. Id. After reviewing numerous cases from other jurisdictions, the McClung Court concluded that the Cornpropst rule was obsolete. Id. at 900. The Court stated, "It makes little sense to ignore the frequency and nature of criminal activity in the immediate vicinity of the business, such as an adjacent parking lot, if the crucial inquiry is the foreseeability of a criminal act occurring on defendant's premises." Id. at 899. The Court also concluded that foreseeability of harm on which liability may be imposed should not be limited to criminal acts of third parties that are known or should be known to pose an imminent probability of harm to customers. Id. In other words, a condition did not have to pose an imminent threat to persons on the premises in order to be relevant to the foreseeability of harm. Id. The Court recognized that "[t]he criminal who intends to strike in defendant's parking lot will not enter defendant's store to announce his intentions and thereby provide defendant actual notice of the impending attack." Id. at 902. Therefore, the Court joined courts from other jurisdictions in imposing "a duty upon business to take reasonable measures to protect their customers from foreseeable criminal attacks." Id. at 899.
The Court noted, however, that many courts disagreed on the meaning of "foreseeability" in this context. The Court rejected the approach taken by some courts called the "prior incidents rule," which required a plaintiff to introduce evidence of prior incidents of crime on or near the premises in order to establish foreseeability. Id. The Court also rejected the unpredictable "totality of the circumstances" approach taken in other jurisdictions, which required a broad consideration of all the circumstances surrounding the business, its location, and crime level. Id. Instead, the Court adopted a balancing approach "consistent with our prevailing principles of fairness and justice." Id. at 901. Under that approach, "[a] risk is unreasonable and gives rise to a duty to act with due care if the foreseeable probability and gravity of harm posed by defendant's conduct outweigh the burden upon defendant to engage in alternative conduct that would have prevented the harm." Id. (citing McCall, 913 S.W.2d at 153). The Court adopted the following specific principles "to be used in determining the duty of care owed by the owners and occupiers of business premises to customers to protect them against the criminal acts of third parties":
Several factors are to be considered in deciding whether a risk is an unreasonable one, thereby giving rise to a duty, including:
the foreseeable probability of the harm or injury occurring; the possible magnitude of the potential harm or injury; the importance or social value of the activity engaged in by defendant; the usefulness of the conduct to defendant; the feasibility of alternative, safer conduct and the relative costs and burdens associated with that conduct; the relative usefulness of the safer conduct; and the relative safety of alternative conduct.
McClung , 937 S.W.2d at 901.
A business ordinarily has no duty to protect customers from the criminal acts of third parties which occur on its premises. The business is not to be regarded as the insurer of the safety of its customers, and it has no absolute duty to implement security measures for the protection of its customers. However, a duty to take reasonable steps to protect customers arises if the business knows, or has reason to know, either from what has been or should have been observed or from past experience, that criminal acts against its customers on its premises are reasonably foreseeable, either generally or at some particular time.
In determining the duty that exists, the foreseeability of harm and the gravity of harm must be balanced against the commensurate burden imposed on the business to protect against that harm. In cases in which there is a high degree of foreseeability of harm and the probable harm is great, the burden imposed upon defendant may be substantial. Alternatively, in cases in which a lesser degree of foreseeability is present or the potential harm is slight, less onerous burdens may be imposed. . . . In short, "the degree of foreseeability needed to establish a duty decreases in proportion to the magnitude of the foreseeable harm" and the burden upon defendant to engage in alternative conduct. Pittman v. Upjohn Co., 890 S.W.2d at 433 (Tenn. 1994). "As the gravity of the possible harm increases, the apparent likelihood of its occurrence need be correspondingly less to generate a duty of precaution." [W. Keeton, Prosser and Keeton on the Law of Torts § 53 at 171 (5th ed. 1984)]. The degree of foreseeability needed to establish a duty of reasonable care is, therefore, determined by considering both the magnitude of the burden to defendant in complying with the duty and magnitude of the foreseeable harm.
As a practical matter, the requisite degree of foreseeability essential to establish a duty to protect against criminal acts will almost always require that prior instances of crime have occurred on or in the immediate vicinity of defendant's premises. Courts must consider the location, nature, and extent of previous criminal activities and their similarity, proximity, or other relationship to the crime giving rise to the cause of action. To hold otherwise would impose an undue burden upon merchants.
Id. at 902 (footnote omitted). This approach, the Court explained, would appropriately address both the economic concerns of businesses and the safety concerns of customers. Id.
Applying these principles to the facts in McClung , the Court concluded that the attack on the customer was foreseeable. Police records indicated that during the seventeen months prior to the abduction, there were 164 criminal incidents occurring on or near the defendants' parking lot, including a bomb threat, fourteen burglaries, twelve reports of malicious mischief, ten robberies, thirty-six auto thefts, ninety larcenies, and one attempted kidnaping in an adjacent parking lot. Id. at 904. The Court noted that all of these crimes occurred on or in the immediate vicinity of the defendants' parking lot, within a relatively short period of time, and involved "a significant threat of personal harm." Id. The record also established that the defendants' business was located in a "high crime area," and that other nearby retailers utilized security measures to protect their customers. Id. In addition, the Wal-Mart manager testified that he would not store items outside or hold "sidewalk sales" out of fear that merchandise would be stolen. Id. Based on the record before it, the Court concluded that the risk of injury to the plaintiff's wife was foreseeable. Id.
The Court went on to note, however, that "foreseeability alone does not establish the existence of a duty." Id. On remand, the trial court was instructed to weigh the magnitude of the potential harm and the burden which the duty would impose on the defendants. Id. Specifically, the trial court was instructed to "consider whether imposing a duty to take reasonable measures to protect patrons from the consequences of criminal acts of third persons would place an onerous burden — economic or otherwise — upon defendants." Id. If it did not, then the court was to consider "whether the burden outweighs the foreseeability and gravity of the possible harm, so as to preclude the finding of a duty to take reasonable steps to protect patrons." Id.
In the case before us, ERMC argues that, pursuant to McClung , "only the owner of the premises has a duty to provide security services for the protection of a party plaintiff against the criminal acts of a third party." We recognize that in McClung , the Court stated that it was setting forth principles to be used in determining the duty of care owed by "owners and occupiers of business premises to customers." Id. at 902. However, we disagree with ERMC's assertion that it therefore could not have owed a duty to Mrs. Barron under any circumstances.
In Staples v. CBL Associates, Inc. , 15 S.W.3d 83 (Tenn. 2000), the Supreme Court addressed the issue of duty in a case involving the same defendants named in this case. The plaintiff had been abducted at a shopping mall and forced to drive around with her abductor until she finally escaped. Id. at 85. The plaintiff filed suit against Proffitt's, Inc., the store where she was shopping, CBL Associates, the owner of the mall, and ERMC, the company that provided security for the mall, alleging that the defendants negligently failed to protect her and to implement and maintain an adequate security system in the mall. Id. at 87. The trial court granted summary judgment to all three defendants, and the Court of Appeals affirmed, finding that the defendants did not owe a duty of care to the plaintiff because she failed to show that her abduction was foreseeable. Id. at 88. Applying the analysis set forth in McClung , which it described as "controlling in cases dealing with the duty of care owed by premises owners or occupiers to protect customers from the criminal acts of third parties committed on their premises," the Supreme Court concluded that the attack on the plaintiff was foreseeable. Id. at 85. The plaintiff had informed two Proffitt's employees that she was being stalked, but they did not alert security. Id. at 90. In addition, there were 286 incidents of crime, ranging in severity, that occurred at the mall in the fourteen months preceding the abduction. Id. at 90, n. 3. The Court emphasized that "while the number of prior criminal incidents at [the mall] is significant in determining the existence of a duty, it is only one factor to be weighed by courts and does not by itself establish a duty." Id. The Court went on to find that "the gravity of the foreseeable harm was great and that alternative conduct on the part of the defendants, which at the least would have included calling security, was readily available and would not have unduly burdened the defendants." Id. at 91. Therefore, the Supreme Court held that Proffitt's, the mall, and ERMC owed a duty of care to the plaintiff to take reasonable steps to protect her from the abduction that occurred. Id. at 90.
Although the Supreme Court in Staples did not elaborate on its basis for finding that ERMC also owed a duty to the plaintiff, it appears that ERMC would have been subject to liability pursuant to section 324A of the Restatement (Second) of Torts, which provides:
§ 324A. Liability To Third Person For Negligent Performance Of Undertaking
One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking, if
(a) his failure to exercise reasonable care increases the risk of such harm, or
(b) he has undertaken to perform a duty owed by the other to the third person, or
(c) the harm is suffered because of reliance of the other or the third person upon the undertaking.
(emphasis added). This section "applies specifically to parties who voluntar[ily] assume the duty to protect others from foreseeable risk." Collins v. Arnold , No. M2004-02513-COA-R3-CV, 2007 WL 4146025, at *14 (Tenn.Ct.App. Nov. 20, 2007) perm. app. denied (Tenn. Apr. 14, 2008). Similarly, in this case, if ERMC undertook, for consideration, to perform a duty owed by CBL to third parties, which it should have recognized as necessary for the protection of third parties, ERMC would be subject to liability to the third parties for physical harm resulting from its failure to exercise reasonable care in its undertaking. See Restatement (Second) of Torts § 324A(b). Therefore, we reject ERMC's argument that it had no duty to protect Mrs. Barron under any circumstances simply because it was not the owner or occupier of the business premises where she was injured.
Although the Supreme Court has not explicitly adopted section 324A as establishing the only situations under which liability attaches under an assumed duty, "the Tennessee Supreme Court has quoted and applied the conditions set out in Restatement § 324A(a)-(c) in a context indicating that those conditions establish the applicable bases for liability when there has been a breach of the assumed duty of reasonable care." Collins , 2007 WL 4146025, at *14.
For example, in Biscan v. Brown , 160 S.W.3d 462, 483 (Tenn. 2005), the Court explained that the defendant, who had assumed a duty, could be liable if any of the three conditions in section 324A were present.
In Speaker v. Cates Co. , 879 S.W.2d 811, 813 (Tenn. 1994), a landlord had hired a security company to provide security services at an apartment complex. When analyzing the duty owed by the security company to the apartment tenants, the Supreme Court cited section 324A and explained that "the duty of one engaged by a landlord to carry out the landlord's duty of care owed tenants is no greater than that of the landlord itself unless a greater duty is assumed." Id. at 816.
The Middle Section of this Court, in Collins , 2007 WL 4146025, at *14, concluded that "if confronted with the question directly, the [Supreme] Court would hold that Section 324A, including subsections (a) through (c), establishes the law in Tennessee regarding liability under a duty that is voluntarily assumed." Therefore, the Collins Court held that it was reversible error for a trial court to refuse to give a requested jury instruction based on section 324A. Id. at 15. The Supreme Court denied the application for permission to appeal filed in Collins . We agree with the Collins Court's conclusion that the Supreme Court would explicitly adopt section 324A if confronted with the question directly, and we find section 324A applicable to this case.
Next, ERMC argues that it was properly granted summary judgment because it had no duty or ability to increase the number of mobile units, as it was contractually bound to provide the level of security requested by the mall. Specifically, ERMC states in its brief:
[I]t is clear from the facts that the defendant, ERMC, only provided the security requested and required by the owner, CBL. (R. at 110-191). They had no authority, as alleged by the plaintiffs and their expert, to increase the amount of security available. . . .
Later in its brief, ERMC describes itself as "merely a tool of the owner," stating that it "could have provided as much or as little security as the owner desired," but that it was bound by the amount requested.
We recognize the possibility that the scope of a security company's assumed duty, or its ability to provide a different level of security, could be limited by its contract with the business owner. However, ERMC simply failed to present any evidence to suggest that that is the case here. The contract between ERMC and CBL is not included in the record before us. Despite many statements and assertions made by ERMC's counsel regarding its contractual obligations and limitations, the only evidence in the record regarding these issues appears in Mrs. Barron's deposition. Mrs. Barron testified that on a "normal day," ERMC utilized two mobile security units for patrolling the parking lot, and because the mall was so busy on the day of the attack, she expected that ERMC would have used at least two mobile units, possibly even four. Mrs. Barron acknowledged that she was not exactly sure who made the decision regarding the level of security that would be provided, but she assumed that it was ERMC's security director, Jeff Smith. ERMC did not present any evidence to disprove Mrs. Barron's statements or otherwise indicate that it was not responsible for determining the level of security to be provided in the parking lots. Although ERMC's brief states that it only provided "the security requested and required by the owner," its citation to the record, "R. at 110-191," provides no support for this statement. Additionally, at oral argument, counsel for ERMC was specifically asked about the documents in the record that would indicate the level of security it was contractually bound to provide, and counsel referred us to its security expert's affidavit. However, the only relevant statement we find in ERMC's expert report simply states that "[t]he officers are assigned according to the traffic in the mall, an accepted practice in mall security." There is no evidence as to who makes the decision regarding the officers' assignments. In short, we find no evidence in the record to support ERMC's argument that it had no ability or duty to provide additional security in the parking lots due to its contract with the business owner. Thus, ERMC was not entitled to summary judgment on that basis.
We note that the trial judge stated, when announcing his ruling from the bench, "ERM C was operating under contract, contract which is not disputed under the facts today, that coverage would be provided for security as required by the owner, owner being CBL, the mall. . . ." However, there is no such contract in the record, nor is there any testimony regarding the terms of the contract.
The eighty-one pages of the record cited by ERMC's brief include its "Statement of Undisputed Facts in Support of Motion for Summary Judgment," and Exhibits A through F, including affidavits, ERMC's security policy manual, and incident reports for crimes occurring at the mall.
V. CONCLUSION
We reject ERMC's arguments that it did not owe a duty to Mrs. Barron under any circumstance either because it was not the owner of the premises or because it was contractually bound to provide a limited level of security. As previously discussed, we find that ERMC could be subject to liability pursuant to the Restatement (Second) of Torts section 324A by undertaking the business owner's duty to render services for the protection of third parties, if ERMC failed to exercise reasonable care in its undertaking. However, ERMC's duty would be no greater than that of the business owner itself unless a greater duty was assumed. See Speaker v. Cates Co. , 879 S.W.2d 811, 816 (Tenn. 1994). Again, there is nothing in the record before us regarding the scope of the duty assumed by ERMC. In addition, the trial court did not address whether the business owner would have owed a duty of care under McClung , and ERMC does not address that issue or the issue of foreseeability on appeal. Under McClung , the analysis of whether a duty was owed by the business owner would require consideration of whether imposing a duty would place an onerous burden, economic or otherwise, on the defendant, and whether the burden outweighed the foreseeability and gravity of the possible harm. See McClung , 937 S.W.2d at 904 ("[F]oreseeability alone does not establish the existence of a duty."). Based on the state of the record before us, we will not address those issues.
In sum, we will not define the extent of ERMC's duty, if any, on appeal. We simply hold that the trial court erred in granting summary judgment to ERMC on the basis that it owed no duty to Mrs. Barron under any circumstances. We reverse the decision of the circuit court and remand for further proceedings. Costs of this appeal are taxed to the appellees, Emerson Russell Maintenance Company d/b/a ERMC, d/b/a ERMC II, L.P., d/b/a ERMC L.P.; ERMC of America, LLC; ERMC IV, L.P.; and ERMC V, L.P., for which execution may issue if necessary.