
937 S.W.2d 891 (1996)
Roger L. McCLUNG, Individually and on behalf of his Minor Children, Bridget L. McClung, Kyle L. McClung, and Benjamin L. McClung, Plaintiff/Appellant,
v.
DELTA SQUARE LIMITED PARTNERSHIP, a North Carolina Limited Partnership, Delta Square G.P., Inc., a North Carolina Corporation, Samuel M. Longiotti, and Wal-Mart Stores, Inc., a Delaware Corporation, Defendants/Appellees.
Supreme Court of Tennessee, at Jackson.
October 28, 1996.
*893 Bruce S. Kramer, Melissa R. Magee, Borod & Kramer, Memphis, for Appellant.
Tom Nelson National Victim Center, Arlington, VA, Jeffrey R. White, Association of Trial Lawyers of America, Washington, D.C., John H. Stein, National Organization for Victim Assistance, Washington, D.C., Tracy Shaw, Alice Margaret Essary, International Mass Retail Association, Nashville, Kenneth R. Shuttleworth, Archie Sanders, III, Tennessee Defense Lawyers Association, R. Sadler Bailey, Tennessee Trial Lawyers Association, Memphis, Mary Ann Parker, Trial Lawyers for Public Justice, P.C. Nashville, Leslie Bruechner, Trial Lawyers for Public Justice, P.C. Washington, D.C., Jane Nady Burnley, Victims' Assistance Legal Organization, Inc., McLean, VA, for Amicus Curiae.
John D. Richardson, Kevin Combs, The Richardson Law Firm, Memphis, for Appellee Delta Square Limited Partnership, Delta Square G.P., Inc., and Samuel M. Longiotti.
W.O. Luckett, Jr., Rossie, Luckett, Parker & Laughlin, Memphis, for Appellee Wal-Mart Stores, Inc.

OPINION
WHITE, Justice.
This case presents the question of the continued viability of Cornpropst v. Sloan, 528 S.W.2d 188 (Tenn. 1975), in which this Court strictly limited the duty of care owed by owners and occupiers of business property to customers. Here, plaintiff's wife, a customer at a shopping center, was abducted from the parking lot, and later raped and murdered. Plaintiff sought recovery against defendants, owners, operators, and tenants, based on negligence for not providing security in their parking lot. The trial court granted summary judgment in favor of defendants and the Court of Appeals affirmed. We granted plaintiff's application for permission to appeal to review the standard for determining business owner liability for injuries occurring on the business premises and caused by the criminal acts of third parties.

I.
On September 7, 1990, thirty-seven year-old Dorothy McClung, plaintiff's wife, went shopping at Wal-Mart in the Delta Square Shopping Center in Memphis. As she was returning to her parked car around noon, *894 Mrs. McClung was abducted at gunpoint and forced into her car by Joseph Harper, a fugitive from Chattanooga.[1] Later, Harper raped Mrs. McClung and forced her into the trunk of her car where she suffocated. Her body was found by hunters in a field in Arkansas the day after the abduction. Harper confessed, and was convicted of kidnapping, rape, and murder. He committed suicide after being sentenced to life in prison.
Plaintiff filed suit against defendants on his own behalf and on behalf of his and Mrs. McClung's three minor children. In his suit, he alleged that defendant Wal-Mart, the anchor tenant at the Delta Square Shopping Center, and defendant Delta Square, the owner and operator of the center, were negligent in failing to provide security measures for the parking lot and that their negligence was the proximate cause of Mrs. McClung's death.
Feeling compelled to follow this Court's decision in Cornpropst v. Sloan, 528 S.W.2d 188 (Tenn. 1975), the trial court reluctantly granted defendants' motions for summary judgment. The trial judge noted that he was "bothered by the view that the entrepreneur has no responsibility irrespective of the nature of the risk created outside of the place of business  the risk of criminal activity." In affirming the grant of summary judgment, the Court of Appeals observed that "[a]lthough the Supreme Court may wish to adopt a broader rule of liability for shopping center owners, operators, and merchant tenants, we are constrained to follow the test established in Cornpropst." We granted review to determine whether the decision in Cornpropst should be retained as the rule for determining liability under circumstances in which injury occurring on business premises is caused by the criminal acts of third persons.

II.

A.
As is noted, this case is before the Court on the trial court's grant of summary judgment. Therefore, we must review the record without attaching any presumption of correctness to the trial court's judgment to determine whether the absence of genuine issues of material facts entitle defendants to judgment as a matter of law. Carvell v. Bottoms, 900 S.W.2d 23 (Tenn. 1995); Anderson v. Standard Register Co., 857 S.W.2d 555 (Tenn. 1993); Byrd v. Hall, 847 S.W.2d 208 (Tenn. 1993). In reviewing the record, we must view the evidence in the light most favorable to plaintiff and draw all inferences in plaintiff's favor. If both the facts and conclusions to be drawn from the facts permit a reasonable person to reach only one conclusion, summary judgment should be granted. Carvell v. Bottoms, 900 S.W.2d at 26.

B.
To establish negligence, one must prove: (1) a duty of care owed by defendant to plaintiff; (2) conduct falling below the applicable standard of care that amounts to a breach of that duty; (3) an injury or loss; (4) cause in fact; and (5) proximate, or legal, cause. McCall v. Wilder, 913 S.W.2d 150, 153 (Tenn. 1995). Our focus here is primarily on the first element: the duty of care. That question  the duty which the defendant owed plaintiff  is a question of law to be determined by the court. Pittman v. Upjohn Co., 890 S.W.2d 425, 428 (Tenn. 1994); Bradshaw v. Daniel, 854 S.W.2d 865, 869 (Tenn. 1993).
We have defined duty of care to be the legal obligation owed by defendant to plaintiff to conform to a reasonable person standard of care for protection against unreasonable risks of harm. McCall v. Wilder, 913 S.W.2d at 153. The "imposition of a legal duty reflects society's contemporary policies and social requirements concerning the right of individuals and the general public to be protected from another's act or conduct." Bradshaw v. Daniel, 854 S.W.2d at 870. "Indeed, it has been stated that *895 `duty is not sacrosanct in itself, but is only an expression of the sum total of those considerations of policy which lead the law to say that the plaintiff is entitled to protection.'" Id. (quoting W. Keeton, Prosser and Keeton on the Law of Torts § 53 at 358 (5th ed. 1984)); accord Craig v. A.A.R. Realty Corp., 576 A.2d 688, 692 (Del.Sup. 1989) (duty is "frequently an expression by the court of evolving public policy").
Assuming a duty is owed, it must be determined whether defendant has exercised reasonable care under the circumstances. McCall v. Wilder, 913 S.W.2d at 153. If defendant has not, the duty has been breached. Id. at 153-54. In this regard, we have observed that "[t]he term reasonable care must be given meaning in relation to the circumstances. Ordinary, or reasonable, care is to be estimated by the risk entailed through probable dangers attending the particular situation and is to be commensurate with the risk of injury." Doe v. Linder Const. Co., Inc., 845 S.W.2d 173, 178 (Tenn. 1992) (citations omitted).
The trial court and the Court of Appeals based the award of summary judgment in this case on Cornpropst v. Sloan, 528 S.W.2d 188 (Tenn. 1975), in which this Court held that shop owners do not owe to customers a duty to protect them against criminal acts of third parties unless the owner knew or should have know the acts were occurring or about to occur. In that case, decided more than two decades ago, a female shopper, while walking to her car in a shopping center's parking lot, was assaulted and narrowly escaped being kidnapped. She sued the shopping center's owners, operators, and tenants for negligence in failing to provide adequate security measures to protect customers from reasonably foreseeable criminal conduct. She alleged that there were no security guards in the parking lot and that no other protective measures were used or installed. She claimed that, prior to her attack, other acts of violence had occurred either on the premises or in the immediate area of the shopping center. Cornpropst v. Sloan, 528 S.W.2d at 190-91. Thus, plaintiff contended that defendants were negligent in that they "knew, or in the exercise of reasonable care and ordinary care should have known ... that the Plaintiff invitee would be exposed to potential danger and personal harm, and unprotected against criminal acts... ." Id. at 191.
The Court in Cornpropst began its analysis by observing that the common law imposed no duty on anyone, except the government, to protect others from criminal acts of unknown third persons, even though it did impose upon merchants a duty to exercise reasonable care to maintain their premises in a reasonably safe condition. Cornpropst v. Sloan, 528 S.W.2d at 191. The Court noted, however, that exceptions to the common law rule had developed in circumstances in which a "special relationship", such as a common carrier and passenger or innkeeper and guest, existed between the parties, but refused to base liability on the relationship between the owner or occupier of business property and the customer. Id. at 191-93.
Choosing to follow the then-prevailing rule, the Cornpropst Court refused to impose a duty in the case which it characterized as involving "vague allegation[s] that various crimes, assaults and other acts of violence had been committed either on the premises or in the immediate area." Id. at 193. The Court deemed it unfair to impose a duty upon the shopping center owner because the attacker "gave no notice by word, act, dress or deed prior to the commission of the attack that would have indicated to anyone an intention of purpose to commit an assault." Id. at 197. In affirming the dismissal of the complaint, the Court adopted the following rule, which has become the analytical focal point in these types of cases:
There is no duty upon the owners or operators of a shopping center, individually or collectively, or upon merchants and shopkeepers generally, whose mode of operation of their premises does not attract or provide a climate for crime, to guard against the criminal acts of a third party, unless they know or have reason to know that acts are occurring or about to occur on the premises that pose imminent probability of harm to an invitee; whereupon a duty of reasonable care to protect against such act arises.
*896 Id. at 198 (emphasis added). Thus, Cornpropst established the principle in Tennessee that businesses not attracting or providing a favorable environment for crime have no duty to protect customers, unless (1) the business knows or has reason to know that criminal acts are occurring or about to occur on the premises, which (2) pose an imminent probability of harm to a customer. In determining whether the business had reason to know, the Court concluded that "[c]onditions in the area [of the defendant business] are irrelevant." Id. at 197.
The Court's decision was not unanimous. In a dissent, Justice Henry opined that the standard "affords virtually no protection to shopping center invitees ... and virtually immunizes the owner against liability... ." Id. at 200 (Henry, J., dissenting). He found the rule to be unduly restrictive and "not in the best interest of the consuming public" given the "modern phenomenon of merchandising and marketing through community shopping centers" that result in "enormous congregations of potential and actual shoppers in relatively compact areas... ." Id. at 199-200 (Henry J., dissenting). Justice Henry advocated (as did the trial judge in this case) the adoption of the rule expressed in the Restatement (Second) of Torts, § 344 (1965). That rule provides:
A possessor of land who holds it open to the public for entry for ... business purposes is subject to liability to members of the public while they are upon the land for such a purpose, for physical harm caused by the accidental, negligent, or intentionally harmful acts of third persons or animals, and by the failure of the possessor to exercise reasonable care to (a) discover that such acts are being done or are likely to be done, or (b) give a warning adequate to enable the visitors to avoid the harm, or otherwise to protect them against it.
Cornpropst v. Sloan, 528 S.W.2d at 201 (Henry, J., dissenting). Justice Henry relied specifically upon comment (f) to section 344[2] to suggest that a merchant might know or have reason to know of the likelihood of criminal conduct by unknown third persons based upon past experience. Therefore, he suggested that a duty of care should be present in such circumstances even though the merchant has no reason to expect criminal conduct by any particular person at a particular time. The Cornpropst majority labeled the Restatement approach as "patently unfair and unjust" because it was based on a "vague" duty. Id. at 195.
Although Cornpropst is the only case of its kind decided by this Court, the Court of Appeals has decided several similar cases. See, e.g., Lewter v. O'Connor Mgmt. Inc., 886 S.W.2d 253 (Tenn. App. 1994), Gray v. McDonald's Corp., 874 S.W.2d 44 (Tenn. App. 1993); Page v. American Nat. Bank & Trust Co., 850 S.W.2d 133 (Tenn. App. 1991). These decisions and others not reported have interpreted Cornpropst's "imminent probability" requirement to require "actual notice of the imminent probability of the [criminal] act, as distinguished from the knowledge that other similar acts had occurred in the past and similar acts might occur in the future." See, e.g., Lewter v. O'Connor Mgmt. Inc., 886 S.W.2d at 258. An unreported case has construed Cornpropst's imminent harm requirement to be present only if criminal acts were presently occurring or about to occur on defendant's premises. The intermediate court has declined to deem past criminal acts as sufficient to give defendant notice and consistently has deemed conditions in the area surrounding defendant's premises as irrelevant. See, e.g., Gray v. McDonald's Corp., 874 S.W.2d at 45. No Tennessee case has found that facts similar to those in Cornpropst or in the case before the Court imposed *897 a duty of care upon which liability could be based.[3]

C.
The Cornpropst Court had little case law to guide its decision. See generally Annotation, Liability of Owner or Operator of Shopping Center, or Business Housed Therein, for Injury to Patron on Premises from Criminal Attack by Third Party, 93 A.L.R.3d 999 (1979). Since Cornpropst, however, numerous courts and commentators have considered a business owner's duty to protect its customers from injuries caused by criminal acts of unknown third persons.[4] Not only has the subject received considerable attention in the legal literature, courts, as a result of the prevalence of violent crimes at commercial establishments, have reexamined the law. See Craig v. A.A.R. Realty Corp., 576 A.2d at 693 n. 4 ("As the means of merchandising has changed to shopping centers and malls with attendant private parking, the common law concerning the business property owner's liability to customers for personal injury by criminal attacks ... in the parking lots has also been undergoing drastic change."); Comment, Business Owners' Duty to Protect Invitees from Third-Party Criminal Attacks, 54 Mo. L. Rev. 443, 455 (1989)("The imposition of liability upon business owners for third-party criminal attacks upon their premises is quickly becoming a well recognized and viable theory of recovery."); see also Comment, Business Inviters' Duty to Protect Invitees From Criminal Acts, 134 U. Pa. L.Rev. 883, 886 (1986). Parking lots in particular have provided fertile ground for crime because customers usually possess money or recently purchased merchandise. Thus, the criminal "in search of valuables need not take a chance on the unknown assets of some passerby." Id. at 886. Even so, while courts agree that businesses have a duty to exercise reasonable care in maintaining their premises in a reasonably safe condition, disagreement still exists on whether that duty encompasses taking any measures to protect customers from injuries caused by the criminal acts of unknown third persons. Id. at 888.
In the early cases, courts generally denied recovery to customer victims under the theory that the business had no duty to protect its patrons from criminal attacks. See, e.g., Davis v. Allied Supermarkets, Inc., 547 P.2d 963 (Okla. 1976); Cook v. Safeway Stores, Inc., 354 A.2d 507 (D.C. Cir.1976); Nigido v. First Nat. Bank of Baltimore, 264 Md. 702, 288 A.2d 127 (1972); Radloff v. Nat. Food Stores, Inc., 20 Wis.2d 224, 121 N.W.2d 865 (1963); Goldberg v. Housing Auth. of Newark, 38 N.J. 578, 186 A.2d 291 (1962)[5]. The initial reluctance to impose a duty was attributed to several reasons, including general principles of fairness given the unpredictable *898 nature of criminal conduct, see, e.g., Goldberg v. Housing Auth. of Newark, 186 A.2d at 297[6]; Davis v. Allied Supermarkets, Inc., 547 P.2d at 965;[7] fear of creating an undue economic burden upon commercial enterprise and the consuming public, see, e.g., Nappier v. Kincade, 666 S.W.2d 858, 860 (Mo. App. 1984); belief that protecting citizens is a function of the government that should not be shifted to the private sector, see, e.g., id.; desire that merchants not become insurers of customer safety, see, e.g., Shaner v. Tucson Airport Auth., Inc., 117 Ariz. 444, 573 P.2d 518, 522 (App. 1977); and the notion that the criminal's act constituted a superseding, intervening cause sufficient to break the causational chain of liability, see, e.g., Ford v. Monroe, 559 S.W.2d 759, 762 (Mo. App. 1977). These justifications for not imposing a duty relied upon in Cornpropst, form the basis of defendants' argument here.
Notwithstanding the reluctance to impose a duty on business owners, the majority of courts that have considered the issue have been unwilling to hold that a business never has a duty to protect customers from criminal acts. Instead, most have held that, while not insurers of their customers' safety, businesses do have a duty to take reasonable precautions to protect customers from foreseeable criminal acts. Taco Bell, Inc. v. Lannon, 744 P.2d 43, 46-47 (Colo. 1987). This is the position taken in section 344 of the Restatement (Second), comment f, and followed by several states. See, e.g., Zueger v. Carlson, 542 N.W.2d 92, 96-97 (N.D. 1996); Erichsen v. No-Frills Supermarkets, 246 Neb. 238, 518 N.W.2d 116, 118-19 (1994); Mundy v. Dept. of Health & Human Res., 620 So.2d 811, 813-14 (La. 1993); Cotterhill v. Bafile, 177 Ariz. 76, 865 P.2d 120, 122-23 (App. 1993); Doud v. Las Vegas Hilton Corp., 109 Nev. 1096, 864 P.2d 796, 799 (1993); Taco Bell, Inc. v. Lannon, 744 P.2d at 48; Madden v. C & K Barbecue Carryout, Inc., 758 S.W.2d 59, 62 (Mo. 1988); Jardel Co., Inc., v. Hughes, 523 A.2d 518, 525 (Del. 1987); Martinko v. H-N-W Associates, 393 N.W.2d 320, 321-22 (Iowa 1986); Butler v. Acme Markets, Inc., 89 N.J. 270, 445 A.2d 1141, 1145-46 (1982); Foster v. Winston-Salem Joint Venture, 303 N.C. 636, 281 S.E.2d 36, 38-39 (1981); Nallan v. Helmsley-Spear, Inc., 50 N.Y.2d 507, 429 N.Y.S.2d 606, 612-14, 407 N.E.2d 451, 457-58 (1980); Uihlein v. Albertson's, Inc., 282 Or. 631, 580 P.2d 1014, 1018 (1978); see also Donnell v. Spring Sports, Inc., 920 S.W.2d 378, 383 (Tex.Civ. App. 1996) (duty imposed when third party's criminal conduct is a foreseeable result of premise's owner's negligence); Ann M. v. Pacific Plaza Shopping Center, 6 Cal.4th 666, 25 Cal. Rptr.2d 137, 142, 863 P.2d 207, 212 (1993) (foreseeability is crucial factor in determining existence of duty to protect against criminal acts); Seibert v. Vic Regnier Builders, Inc., 253 Kan. 540, 856 P.2d 1332, 1338 (1993) (duty to protect patrons exists when business "could reasonably foresee that its customers have a risk of peril above and beyond the ordinary and that appropriate security means should be taken."); Shell Oil Co. v. Diehl, 205 Ga. App. 367, 422 S.E.2d 63, 64 (1992) ("The proprietor of a business has a duty, when he can reasonably apprehend danger to a customer from the misconduct of [others] to exercise ordinary care to protect the customer... ."); Lucht v. Stage 2, Inc., 239 Ill. App.3d 679, 179 Ill.Dec. 918, 922, 606 N.E.2d 750, 754 (1992) (businesses owe customers a duty "to reasonably guard against *899 acts of third parties when such attacks are reasonably foreseeable"); Erickson v. Curtis Inv. Co., 447 N.W.2d 165, 168-69 (Minn. 1989) (duty to protect patrons depends, in part, on foreseeability of risk involved); Bullard v. Ehrhardt, 283 S.C. 557, 324 S.E.2d 61, 62 (1984) ("The duty of a store owner to its invitees is to take reasonable care to protect them. This duty does not extend to protection from criminal attacks from third parties unless the store owner knew or had reason to know of the criminal attack.").
Based on this analysis of the decisions of other jurisdictions, we must disavow the observation made in Cornpropst that "conditions in the area [of the defendant business] are irrelevant" in assessing the foreseeability of a criminal act. Cornpropst v. Sloan, 528 S.W.2d at 197. It makes little sense to ignore the frequency and nature of criminal activity in the immediate vicinity of the business, such as an adjacent parking lot, if the crucial inquiry is the foreseeability of a criminal act occurring on defendant's premises. Conditions in the immediate vicinity of defendant's premises are relevant in making this determination. We also find that foreseeability of harm on which liability may be imposed is not limited to criminal acts of third parties that are known or should be known to pose an imminent probability of harm to customers. Id. at 198. Conditions other than those which pose an imminent threat to persons on the premises are relevant to the foreseeability of harm.
We, therefore, join those courts which generally impose a duty upon businesses to take reasonable measures to protect their customers from foreseeable criminal attacks. Because those courts do not universally agree on the meaning of "foreseeability," further consideration is required. In determining foreseeability, some courts have utilized the so-called "prior incidents rule." See, e.g., Polomie v. Golub Corp., ___ A.D.2d ___, 640 N.Y.S.2d 700 (1996); Thiele v. Rieter, 838 S.W.2d 441 (Mo. Ct. App. 1992); Galloway v. Bankers Trust Co., 420 N.W.2d 437 (Iowa 1988); Tolbert v. Captain Joe's Seafood, Inc., 170 Ga. App. 26, 316 S.E.2d 11 (1984); Taylor v. Hocker, 101 Ill. App.3d 639, 57 Ill.Dec. 112, 428 N.E.2d 662 (1981). Under this rule, plaintiff must introduce evidence of prior incidents of crime on or near defendant's premises in order to establish foreseeability. Courts vary, however, on whether the prior crimes must be of the same general type and nature as the present offense. See, e.g., Taylor v. Hocker, 57 Ill.Dec. at 114-15, 428 N.E.2d at 664-65 (holding that previous crimes against property were insufficient to give rise to a duty to protect customers from personal assaults); Polomie v. Golub Corp., 640 N.Y.S.2d at 701 ("[T]here is no requirement that the past experience relied on to establish foreseeability be of the same type of criminal conduct to which plaintiff was subjected... ."); Jardel Co., Inc. v. Hughes, 523 A.2d at 525 (limiting the foreseeability standard to the same crime as the one complained of is unrealistic because "[s]o called `property crimes,' such as shoplifting, may turn violent if a chase ensues... ."); Galloway v. Bankers Trust Co., 420 N.W.2d at 439 (same). The modern trend, however, does not deem foreseeability as necessarily dependent upon evidence of the same type of prior crimes occurring on or near defendant's premises, Doud v. Las Vegas Hilton Corp., 864 P.2d at 799-800, but requires "inquiry [into] the location, nature and extent of previous criminal activities and their similarity, proximity or other relationship to the crime in question." Polomie v. Golub Corp., 640 N.Y.S.2d at 701.
The prior incidents approach to foreseeability has been lauded as preventing businesses from effectively becoming insurers of public safety since "[i]t is difficult, if not impossible, to envision any locale open to the public where the occurrence of violent crime seems improbable." Ann M. v. Pacific Plaza Shopping Center, 25 Cal. Rptr.2d at 144-46, 863 P.2d at 215-16. At the same time, the rule has been labeled "fatally flawed" in several respects:
First, the rule leads to results which are contrary to public policy. The rule has the effect of discouraging landowners from taking adequate measures to protect premises which they know are dangerous. This result contravenes the policy of preventing future harm. Moreover, under the rule, the first victim always loses, while subsequent *900 victims are permitted recovery. Such a result is not only unfair, but it is inimical to the important policy of compensating injured parties. Surely, a landowner should not get one free assault before he can be held liable for criminal acts which occur on his property.
Second, a rule which limits evidence of foreseeability to prior similar criminal acts leads to arbitrary results and distinctions. Under this rule, there is uncertainty as to how "similar" the prior incidents must be to satisfy the rule. The rule raises a number of other troubling questions. For example, how close in time do the prior incidents have to be? How near in location must they be? The rule invites different courts to enunciate different standards of foreseeability based on their resolution of these questions.
Third, the rule erroneously equates foreseeability of a particular act with previous occurrences of similar acts... . "[T]he fortuitous absence of prior injury does not justify relieving defendant from responsibility for the foreseeable consequences of its acts."
Finally, the "prior similar incidents rule" improperly removes too many cases from the jury's consideration. It is well-established that foreseeability is ordinarily a question of fact.
Isaacs v. Huntington Memorial Hosp., 38 Cal.3d 112, 211 Cal. Rptr. 356, 361-63, 695 P.2d 653, 658-59 (1985) (citations omitted).
Because of these criticisms, several courts have rejected the prior incidents rule in favor of a "totality of the circumstances" approach, in which the foreseeability of criminal conduct may be determined by considering all of the circumstances including the nature or character of the business, its location, and prior incidents of crime, if any. See, e.g., Doud v. Las Vegas Hilton Corp., 864 P.2d 796; Seibert v. Vic Regnier Builder's Inc., 856 P.2d at 1332; Reitz v. May, 66 Ohio App.3d 188, 583 N.E.2d 1071 (1990); Isaacs v. Huntington Memorial Hosp., 211 Cal. Rptr. 356, 695 P.2d 653. The totality approach seeks to avoid determining foreseeability by the "rigid application of a mechanical" prior incidents rule, Isaacs v. Huntington Memorial Hosp., 211 Cal. Rptr. 356, 695 P.2d 653, which requires "finite distinctions between how similar prior incidents must be," Reitz v. May, 583 N.E.2d at 1075.
Nonetheless, the totality of the circumstances approach has been criticized as well, as being too broad a standard, effectively imposing an unqualified duty to protect customers in areas experiencing any significant level of criminal activity. See Ann M. v. Pacific Plaza Shopping Center, 25 Cal. Rptr.2d at 144-45, 863 P.2d at 215. The approach might deem criminal attacks on customers foreseeable as a result of circumstances such as the level of crime in the neighborhood, inadequate lighting, or architectural designs, even if no prior instances of crime had occurred. See Isaacs v. Huntington Memorial Hosp., 211 Cal. Rptr. 356, 695 P.2d 653. As a practical matter, the totality approach arguably requires businesses to implement expensive security measures (with the costs passed on to consumers) and makes them the insurers of customer safety, two results which courts seek to avoid. Businesses may react by moving from poorer areas where crime rates are often the highest. Not surprisingly then, the totality of the circumstances test has been described as "imprecise," "unfair," and "troublesome" because it makes liability for merchants even less predictable than under the prior incidents rule. See Comment, Ann M. v. Pacific Plaza Shopping Center: The California Supreme Court Retreats from its Totality of the Circumstances Approach to Premises Liability, 28 Ga. L.Rev. 1053, 1063 (1994); Kaufman, When Crime Pays: Business Landlord's Duty to Protect Customers from Criminal Acts Committed on the Premises, 31 S. Tex. L.Rev. 89, 112 (1990); Note, Criminal Attacks on the Premises: Landowner's Duty after Isaacs v. Huntington Hospital, 21 Tort & Ins. L.J. 386, 392 (1986).
Having found that because of its severe limitations, the rule advanced in Cornpropst is obsolete, and having found further that the prior incidents rule and the totality of the circumstances approach do not provide a suitable balance between the burden of the duty to be imposed and the nature of the *901 rights to be protected, we turn to our own decisions for guidance in determining the appropriate duty of care.
Our recent pronouncements concerning the duty of care in negligence cases reveal a balancing approach consistent with our prevailing principles of fairness and justice. In McCall v. Wilder, 913 S.W.2d 150 (Tenn. 1995), we observed that "[a] risk is unreasonable and gives rise to a duty to act with due care if the foreseeable probability and gravity of harm posed by defendant's conduct outweigh the burden upon defendant to engage in alternative conduct that would have prevented the harm." McCall v. Wilder, 913 S.W.2d at 153. We have also noted that several factors are to be considered in deciding whether a risk is an unreasonable one, thereby giving rise to a duty. "Those factors include the foreseeable probability of the harm or injury occurring; the possible magnitude of the potential harm or injury; the importance or social value of the activity engaged in by defendant; the usefulness of the conduct to defendant; the feasibility of alternative, safer conduct and the relative costs and burdens associated with that conduct; the relative usefulness of the safer conduct; and the relative safety of alternative conduct." Id. at 153. Thus, resolution of the case before the Court can be accomplished by utilizing existing principles of law which provide the proper analytical framework for determining the duty owed in a particular case.
Similarly, all of our recent cases addressing the existence or non-existence of a duty utilize a balancing approach. See Woodson v. Porter Brown Limestone Co., 916 S.W.2d 896 (Tenn. 1996)(analysis of duty in negligent entrustment case); Eaton v. McLain, 891 S.W.2d 587 (Tenn. 1994)(analysis of whether homeowner's duty of care included duty to guard against guest falling down staircase); Pittman v. Upjohn Co., 890 S.W.2d 425 (Tenn. 1994)(analysis of whether manufacturer of drug, doctor, and pharmacy owed duty to grandson of patient who mistakenly took medication believing it to be aspirin); Haynes v. Hamilton County, 883 S.W.2d 606 (Tenn. 1994)(analysis of duty of police officer to innocent third parties during high-speed chase); Speaker v. Cates Co., 879 S.W.2d 811 (Tenn. 1994)(analysis of duty of owner manager and security service of apartment complex to tenant murdered by former roommate); Bradshaw v. Daniel, 854 S.W.2d 865 (Tenn. 1993)(analysis of duty of physician to non-patient to warn of risks of exposure to Rocky Mountain Spotted Fever); Doe v. Linder Construction Co., 845 S.W.2d 173 (Tenn. 1992)(analysis of duty of builder, real estate broker, and employee to purchaser who was raped by builder's employee); Hames v. State, 808 S.W.2d 41 (Tenn. 1991)(analysis of duty of state-owner of golf course to golfer killed by lightning on course); McClenahan v. Cooley, 806 S.W.2d 767 (Tenn. 1991)(analysis of duty of automobile owner who left keys in car to person injured by thief driving the car).
Thus, our decisions regarding the existence of a duty in a negligence action generally demonstrate a balancing approach. At least one other state, California, has adopted a "balancing" approach to determine duty. This approach retains some beneficial features of both the prior incidents and totality of the circumstances tests, but avoids some of the problems associated with each. Ann M. v. Pacific Plaza Shopping Center, 25 Cal. Rptr.2d 137, 863 P.2d 207. The balancing approach acknowledges that duty is a flexible concept, and seeks to balance the degree of foreseeability of harm against the burden of the duty to be imposed. Id. 25 Cal. Rptr.2d at 144-45, 863 P.2d at 215. A high degree of foreseeability of harm would justify a more onerous burden than would a limited degree of foreseeability of harm. Id. Moreover, the balancing approach recognizes that the presence or absence of prior similar incidents of crime is an important factor in determining the degree of foreseeability. Id. It has been noted that "by establishing [a balancing] approach that [is] more flexible than the strict prior similar incidents rule, [a Court] avoid[s] the pitfalls of that rule while solving the problems of [the] more liberal totality of the circumstances approach." 28 Ga. L.Rev. at 1068-69.

D.
After careful consideration of the jurisprudence of other jurisdictions and our own, we *902 adopt the following principles to be used in determining the duty of care owed by the owners and occupiers of business premises to customers to protect them against the criminal acts of third parties: A business ordinarily has no duty to protect customers from the criminal acts of third parties which occur on its premises. The business is not to be regarded as the insurer of the safety of its customers, and it has no absolute duty to implement security measures for the protection of its customers. However, a duty to take reasonable steps to protect customers arises if the business knows, or has reason to know, either from what has been or should have been observed or from past experience, that criminal acts against its customers on its premises are reasonably foreseeable, either generally or at some particular time.
In determining the duty that exists, the foreseeability of harm and the gravity of harm must be balanced against the commensurate burden imposed on the business to protect against that harm. In cases in which there is a high degree of foreseeability of harm and the probable harm is great, the burden imposed upon defendant may be substantial. Alternatively, in cases in which a lesser degree of foreseeability is present or the potential harm is slight, less onerous burdens may be imposed. By way of illustration, using surveillance cameras, posting signs, installing improved lighting or fencing, or removing or trimming shrubbery might, in some instances, be cost effective and yet greatly reduce the risk to customers. See Seibert v. Vic Regnier Builders, Inc., 856 P.2d at 1339-40. In short, "the degree of foreseeability needed to establish a duty decreases in proportion to the magnitude of the foreseeable harm" and the burden upon defendant to engage in alternative conduct. Pittman v. Upjohn Co., 890 S.W.2d at 433 (Tenn. 1994). "As the gravity of the possible harm increases, the apparent likelihood of its occurrence need be correspondingly less to generate a duty of precaution." Prosser & Keeton on the Law of Torts at 171. The degree of foreseeability needed to establish a duty of reasonable care is, therefore, determined by considering both the magnitude of the burden to defendant in complying with the duty and magnitude of the foreseeable harm.
As a practical matter, the requisite degree of foreseeability essential to establish a duty to protect against criminal acts will almost always require that prior instances of crime have occurred on or in the immediate vicinity of defendant's premises. Courts must consider the location, nature, and extent of previous criminal activities and their similarity, proximity, or other relationship to the crime giving rise to the cause of action.[8] To hold otherwise would impose an undue burden upon merchants.
The balancing approach we adopt appropriately addresses both the economic concerns of businesses and the safety concerns of customers who are harmed due to the negligence of one seeking their business. The interpretation of the notice requirement of Cornpropst, see text preceding n. 2, supra, virtually eliminated these causes of action. The criminal who intends to strike in defendant's parking lot will not enter defendant's store to announce his intentions and thereby provide defendant actual notice of the impending attack. In short, this new rule provides the fairest and most equitable results. It creates a duty in limited circumstances, giving merchants neither absolute immunity nor imposing absolute liability. It recognizes the national trend that businesses must justifiably expect to share in the cost of crime attracted to the business. It encourages a reasonable response to the crime phenomenon without making unreasonable demands.
The standard we adopt is the product of attempts by many jurisdictions to deal with this admittedly difficult issue. While embracing neither the totality of the circumstances *903 nor the prior incidents tests in toto, we have retained the desirable features of both approaches, while avoiding the inherent problems associated with each. For example, we have preserved the primary advantage of the prior incidents rule by not creating an environment where businesses are essentially held strictly liable for customer safety. At the same time, our approach should enable meritorious cases to proceed to the jury which is typical of deserving cases tried under the totality of the circumstances approach. Moreover, rather than having an incentive to do nothing (out of fear of having assumed a duty), businesses will be encouraged to take reasonable security precautions, another characteristic of the totality of the circumstances test.[9] The merchant is in the best position to know the extent of crime on the premises and is better equipped than customers to take measures to thwart it and to distribute the costs. Craig v. A.A.R. Realty Corp., 576 A.2d at 693.[10]

E.
Having established the appropriate test for determining the duty of care in cases involving business premises liability for the acts of unknown third parties and for the purpose of offering an illustration of the analysis required of courts in these type of cases, we return to the facts of the case at bar. Here, plaintiff's wife was returning to her car in defendants' parking lot when she was accosted. Plaintiff argues that because of past crimes committed on or near defendants' parking lot, a requisite degree of foreseeability to impose a duty to take reasonable precautions was established. To support this contention, plaintiff relies upon records from the Memphis Police Department, which indicate that from May, 1989 through September, 1990, when plaintiff's wife was abducted, approximately 164 criminal incidents had occurred on or near defendants' parking lot. He also relies on the fact that defendants' nearby competitors provide outdoor security measures and that Wal-Mart uses heightened security measures at other locations.
In response, defendants argue that no duty of reasonable care should be imposed because the attack on plaintiff's wife was neither foreseeable nor preventible. Defendants claim they had no notice that Harper was likely to abduct plaintiff's wife, no reason to have anticipated the attack when it occurred, and no reasonable way to have prevented it. They also assert that providing security is prohibitively expensive, and that security has little impact on preventing crime.
We reject defendants' argument that it owed plaintiff's wife no duty because the attack was not reasonably foreseeable. In *904 the seventeen months prior to the abduction, the numerous reports of crime to police on or near defendants' premises included a bomb threat, fourteen burglaries, twelve reports of malicious mischief, ten robberies, thirty-six auto thefts, ninety larcenies, and one attempted kidnapping on a parking lot adjacent to defendants' parking lot. All of these crimes occurred on or in the immediate vicinity of defendants' parking lot, took place within a relatively short period of time prior to the abduction of plaintiff's wife, and involved a significant threat of personal harm. The record also establishes that defendants' premises was located in a high crime area, and that other nearby major retail centers utilized security measures to protect customers.[11] The manager of the Wal-Mart store at the time of the abduction testified that he would not hold "sidewalk sales" or place merchandise outside the store, except for "dirt," out of fear it would be stolen.
Considering the number, frequency, and nature of the crimes reported to police, management's acknowledgement of security problems, and other evidence in the record, we conclude that the proof would support a finding that the risk of injury to plaintiff's wife was reasonably foreseeable. Of course, foreseeability alone does not establish the existence of a duty. On remand, the magnitude of the potential harm and the burden imposed upon defendants must also be weighed to determine the existence of a duty. While we know little from this record about the extent of injury to customers as a result of criminal acts on or near defendants' premises, we are persuaded that whatever the extent of the injuries, the magnitude of the potential harm was substantial given the nature of the crimes reported to police.[12]
On remand, the court must also consider the burden which the duty would impose upon defendants. We note, for example, that defendants contend that they have no reasonable means of foreseeing the possibility of crime on their premises; that security measures are not effective in reducing crime; and that providing security is cost prohibitive. These arguments must be considered on remand in light of conflicting information supplied by one of Wal-Mart's senior security and loss prevention executives.[13]
In weighing the magnitude of harm and the burden imposed upon defendant, the court must consider whether imposing a duty to take reasonable measures to protect patrons from the consequences of criminal acts of third persons would place an onerous burden  economic or otherwise  upon defendants. If it does not, then the court must consider whether the burden outweighs the foreseeability and gravity of the possible harm, so as to preclude the finding of a duty to take reasonable steps to protect patrons. We hasten to point out, however, that the question of duty and of whether defendants have breached that duty by taking or not taking certain actions is one for the jury to determine based upon proof presented at trial. Additionally, if properly raised as a defense, under our doctrine of comparative fault, a plaintiff's duty to exercise reasonable care for her own safety would be weighed in the balance. Perez v. McConkey, 872 S.W.2d 897 (Tenn. 1994).
*905 Finally, we must address defendants' argument that random criminal acts of unknown third persons amount to superseding, intervening causes for which defendants cannot be held liable as a matter of law. It is true, as pointed out by defendants, that a superseding, intervening cause can break the chain of causation. In this regard, we have stated that
[t]here is no requirement that a cause, to be regarded as the proximate cause of an injury, be the sole cause, the last act, or the one nearest to the injury, provided it is a substantial factor in producing the end result. An intervening act, which is a normal response created by negligence, is not a superseding, intervening cause so as to relieve the original wrongdoer of liability, provided the intervening act could have reasonably been foreseen and the conduct was a substantial factor in bringing about the harm.
Haynes v. Hamilton County, 883 S.W.2d 606, 612 (Tenn. 1994) (quoting McClenahan v. Cooley, 806 S.W.2d 767, 775 (Tenn. 1991)). Proximate cause, as well as the existence of a superseding, intervening cause, are jury questions unless the uncontroverted facts and inferences to be drawn from the facts make it so clear that all reasonable persons must agree on the proper outcome. Haynes v. Hamilton County, 883 S.W.2d at 612; Cook v. Spinnaker's of Rivergate, Inc., 878 S.W.2d 934, 940 (Tenn. 1994); McClenahan v. Cooley, 806 S.W.2d at 775-76.
In conclusion, this record, viewed in light of the principles set forth in this opinion, precludes an award of summary judgment. Assuming for purposes of this analysis that defendants were negligent, we are unable to conclude that all reasonable persons must agree, as a matter of law, that defendants' negligence in failing to provide any security measures did not create a favorable environment for criminal activity. Considering the number, nature, and frequency of crimes committed on or near defendants' premises, it is not beyond the realm of reasonable anticipation that a jury could conclude that defendants' negligence created a foreseeable risk of harm to plaintiff's wife, and that defendants' negligence was a substantial factor in bringing about that harm. See Tenn. R. Civ. P. 56.03. Such questions are "peculiarly for the jury" given the present state of this record. McClenahan v. Cooley, 806 S.W.2d at 775-76.
For the reasons stated above, the judgments of the lower courts are reversed. The case is remanded to the trial court for further proceedings consistent with this opinion. The principles set forth today apply to all cases tried or retried after the date of this opinion and all cases on appeal in which the issue in this case has been raised. Costs shall be taxed to defendants.
BIRCH, C.J., and DROWOTA, ANDERSON and REID, JJ., concur.
NOTES
[1]  Harper was sought by police for robbing a Chattanooga man, forcing him into the trunk of his car, and stealing the car two days prior to his abduction of Mrs. McClung. It was this stolen car that Harper drove from Chattanooga to the Memphis parking lot where he abducted Mrs. McClung.
[2]  "Duty to police premises. Since the possessor is not an insurer of the visitor's safety, [the possessor] is ordinarily under no duty to exercise any care until [the possessor] knows or has reason to know that the acts of the third person are occurring, or are about to occur. [The possessor] may, however, know or have reason to know, from past experience, that there is a likelihood of conduct on the part of third persons in general which is likely to endanger the safety of the visitor, even though [the possessor] has no reason to expect it on the part of any particular individual. If the place or the character of [the] business, or [the] past experience, is such that [the possessor] should reasonably anticipate careless or criminal conduct on the part of third persons, either generally or at some particular time, [the possessor] may be under a duty to take precautions against it... ." Restatement (Second) of Torts, § 344, comment f (1965).
[3]  The rule adopted in Cornpropst has also been applied to criminal acts of third parties not occurring on defendant's parking lot, or even its premises. See e.g., Louria v. Brummett, 916 S.W.2d 929 (Tenn. App. 1995)(Shooting occurred off defendant's premises by individuals who had previously stolen guns from defendant store); Dellinger v. Pierce, 848 S.W.2d 654 (Tenn. App. 1992)(assault in defendant theater's lobby).
[4]  See, e.g., Comment, Ann M. v. Pacific Plaza Shopping Center: The California Supreme Court Retreats From Its Totality of the Circumstances Approach to Premises Liability, 28 Ga. L.Rev. 1053 (1994); Comment, Business Owners' Duty to Protect Patrons from the Criminal Acts of Third Parties in Louisiana, 53 La. L.Rev. 1847 (1993); Robertson, Negligence Liability for Crimes and Intentional Torts Committed by Others, 67 Tul. L.Rev. 135 (1992); Friedman and Worthington, Trends in Holding Business Organizations Liable for the Criminal Acts of Third Persons on the Premises: A Texas Perspective, 32 S. Tex. L.Rev. 257 (1991); Kaufman, When Crime Pays: Business Landlord's Duty to Protect Customers from Criminal Acts Committed on the Premises, 31 S. Tex. L.Rev. 89 (1990); Comment, Business Owners' Duty to Protect Invitees from Third Party Criminal Attacks, 54 Mo. L.Rev. 443 (1989); Comment, Business Inviters' Duty to Protect Invitees from Criminal Acts, 134 U. Pa. L.Rev. 883 (1986); Comment, "Am I my Brother's Keeper?": Cornpropst v. Sloan, A Business Proprietor's Civil Liability for Criminal Attacks to an Invitee by a Third Party, 9 A.J. Trial Advoc. 473 (1986).
[5]  It should be noted that Goldberg, one of the primary cases relied upon by the majority in Cornpropst, has since been abandoned by the New Jersey Supreme Court, as that court has adopted the approach espoused by Restatement (Second) § 344. Butler v. Acme Markets, Inc., 89 N.J. 270, 445 A.2d 1141 (1982). Ironically, New Jersey law is now consistent with the position taken by Justice Henry in his dissent in Cornpropst.
[6]  can foresee that commission of crime virtually anywhere and at any time. If foreseeability itself gave rise to a duty to provide "police protection for others, every residential curtilage, every shop, every store, every manufacturing plant would have to be patrolled by the private arms of the owner. And since hijacking and attach upon occupants of motor vehicles are also foreseeable, it would be the duty of every motorist to provide armed protection for his passengers and the property of others. Of course, none of this is at all palatable.
The question is not simply whether a criminal event is foreseeable, but whether a duty exists to take measures to guard against it. Whether a duty exists is ultimately a question of fairness... ."
Goldberg v. Housing Auth. of Newark, 186 A.2d at 293.
[7]  "[I]t does not seem that shifting the financial loss caused by crime from one innocent victim to another innocent victim is proper." Davis v. Allied Supermarkets, Inc., 547 P.2d at 965. The Oklahoma Supreme Court repudiated its Davis decision in Lay v. Dworman, 732 P.2d 455, 460 (Okla. 1986).
[8]  This approach is consistent with the approach taken in Doe v. Linder Const. Co., Inc., 845 S.W.2d 173 (Tenn. 1992). There, we dealt with the liability of a builder for an assault occurring to a purchaser of property after a third party and an employee of the builder used the builder's key to enter the premises of the purchaser and commit various crimes. In holding for the builder, we stated that "[finding] circumstances such as minor thefts, unexplained use of a bathroom, and unsubstantiated rumors to be sufficient notice on which to base liability for subsequent criminal assaults is not the law in Tennessee... ." Doe v. Linder Const. Co., Inc., 845 S.W.2d at 180.
[9]  As stated by one of the amicus participants in this case, "[i]f the premises owner does nothing to make himself or herself aware of the potential imminent probability of harm to a customer, then no liability will extend under the [current] rule. The effect is that ignorance translates into nonliability and economic bliss for merchants, while business patrons can easily be victimized by criminals who stalk the malls and parking lots of shopping and retail centers." See also 31 So. Tex. L.Rev. at 110-11 ("Only by imposing a duty to protect will business proprietors have the necessary incentive to take measures that will limit the number of crimes committed... . While very generalized economic incentives will encourage owners to take some steps to reassure customers about their safety, common experience demonstrates that these incentives are not enough to encourage efficient crime prevention.").
[10]  all the involved parties, the cost of crime reduction is cheapest to the landowner. For the criminal, imposing civil liability on him in addition to existing criminal sanctions does not deter him from committing the crime. Imposing duty on the patron, so that he must protect and compensate himself, may result in crime reduction, but only at the expensive cost of the patron staying home. While the patron can prevent crime by not going out at night, the price of staying home is high not only for him but also for society in general. As opposed to the transient patron, who has little information about the crime problem on the landowner's premises and little ability to directly influence it, the landowner can be much more effective in dealing with the problem. While the patron holds just one expensive option, staying home, the landowner holds many options ranging from installation of better lighting, fences, or guard service, to even varying hours of operation. All of these options should be less expensive and much more effective in deterring crime than the patron's sole choice of staying home.
Bazyler, "The Duty to Provide Adequate Protection: Landowner's Liability for Failure to Protect Patrons from Criminal Attack," 21 Ariz L.Rev. 727, 747-48 (1979).
[11]  Although the measures varied, one business even posted guards in five separate watch towers located throughout its parking lot.
[12]  As we have said before, "the degree of foreseeability needed to establish a duty decreases in proportion to the magnitude of the foreseeable harm." Pittman v. Upjohn Co., 890 S.W.2d at 433. Accord, Prosser and Keeton on the Law of Torts at 171 ("As the gravity of the possible harm increases, the apparent likelihood of its occurrence need be correspondingly less to generate a duty of precaution.").
[13]  In an article written for a trade publication, it was acknowledged that 80% of crime at WalMart stores occurred in the parking lots or the exterior perimeter of the stores. The article praised newly implemented parking lot security measures ranging from roving patrols to employees wearing orange vests to surveillance cameras. These measures were said to produce "outstanding" results in reducing crime, helping "halt many crimes in progress," and providing "crucial evidence to local [law enforcement authorities]." The article also noted that the costs of these security measures "wasn't quite as expensive as what [the store] had been doing. So [the store] saved a little money and did much more effective work."
