                  IN THE COURT OF APPEALS OF TENNESSEE
                               AT JACKSON
                                    APRIL 21, 2009 Session

            MAGGIE ANN BARRON, ET AL. v. EMERSON RUSSELL
            MAINTENANCE COMPANY d/b/a ERMC II, L.P., ET AL.

                  Direct Appeal from the Circuit Court for Madison County
                            No. C-04-504    Roy Morgan, Judge



                      No. W2008-01409-COA-R3-CV - Filed July 30, 2009


After being abducted from a mall parking lot, the plaintiff filed suit against the security company that
provided security services to the mall. The trial court granted summary judgment to the security
company, concluding that only the premises owner, i.e., the mall, owed a duty of care to the plaintiff.
Plaintiff appeals. We reverse and remand for further proceedings.


   Tenn. R. App. P. 3; Appeal as of Right; Judgment of the Circuit Court Reversed and
                                       Remanded

ALAN E. HIGHERS, P.J.,W.S., delivered the opinion of the court, in which HOLLY M. KIRBY , J., and
J. STEVEN STAFFORD , J., joined.

David W. Camp, Jackson, TN, for Appellants

Sean Antone Hunt, Memphis, TN, for Appellee
                                                   OPINION

                                   I. FACTS & PROCEDURAL HISTORY

        Sixty-five year-old Maggie Barron was employed as a customer service supervisor by CBL
& Associates Management, Inc., d/b/a Old Hickory Mall, in Jackson, Tennessee. On Saturday, May
8, 2004, at approximately 2:00 p.m., Mrs. Barron was leaving the mall when she was abducted by
two juveniles in the mall parking lot and forced into the back seat of her vehicle. The juveniles took
control of Mrs. Barron’s vehicle and drove it around for several hours, while assaulting Mrs. Barron
and threatening to rape and kill her. The juveniles ultimately wrecked Mrs. Barron’s vehicle and
fled.

         Mrs. Barron and her husband filed this lawsuit against the two juveniles, CBL &Associates
Management, Inc., and Emerson Russell Maintenance Company (“ERMC”).1 Mrs. Barron alleged
that ERMC “was responsible for providing security and protection to the general public and
employees of [the mall],” and that ERMC “had a duty to protect the general public and employees
of [the mall].” Mrs. Barron alleged that ERMC was negligent in failing to properly supervise
activities at the mall; failing to warn of the dangers at the mall; failing to protect Mrs. Barron from
injury; and failing to provide sufficient security so as to protect the safety and welfare of Mrs.
Barron.

        ERMC filed an answer alleging, among other things, that the attack by the two juveniles was
not foreseeable. ERMC subsequently filed a motion for summary judgment claiming that it had no
duty to protect Mrs. Barron from the unforeseeable criminal acts of the two juveniles, but in any
event, ERMC argued, the security measures it implemented were reasonable. In support of its
motion for summary judgment, ERMC submitted the affidavit of Jeff Smith, ERMC’s Director of
Mall Security, who stated that on the date of the attack, ERMC had two uniformed, unarmed security
guards patrolling the interior of the mall and one mobile security unit patrolling the parking lot. In
addition, ERMC offered an “escort” program whereby any mall employee could request a security
escort to his or her vehicle, but Mrs. Barron did not use the escort program on the day of her attack.

       ERMC also submitted the affidavit of Ben Beard, the security guard who was patrolling the
parking lot in the mobile security unit on the day of the attack. Mr. Beard was a certified security
guard and had been working as a security guard at the mall for 19 years. He stated that on the day



         1
            Specifically, Mrs. Barron and her husband named as defendants Emerson Russell M aintenance Company
d/b/a ERMC, d/b/a ERMC II, L.P., d/b/a ERMC L.P.; ERMC of America, LLC; ERMC IV, L.P.; and ERMC V, L.P.
We will refer to these defendants collectively as “ERMC.”
          The only issues presented on appeal involve Mrs. Barron’s claims against ERMC. Mrs. Barron voluntarily
nonsuited her claims against CBL & Associates M anagement, Inc. (“CBL”) after CBL filed a motion to dismiss asserting
that Mrs. Barron’s exclusive remedy against it was pursuant to the Tennessee Workers Compensation Act. The claims
against the two juveniles were still pending when the order resolving the claims against ERMC was entered and made
final pursuant to Tennessee Rule of Civil Procedure 54.02.


                                                        -2-
in question, he did not see any suspicious activity in the parking lot around the time of the abduction.

        ERMC also submitted the “incident reports” it maintained regarding crime at the mall. No
one had ever been carjacked, kidnapped, or raped at the mall. According to the incident reports,
during the twelve months preceding the attack on Mrs. Barron, there were various crimes at the mall,
ranging in severity, including but not limited to six simple assaults, two aggravated assaults, one
verbal assault, two incidents of disorderly conduct, one incident of threatening harassment, one
incident of indecent exposure, one incident of drug possession, one robbery, two aggravated
robberies, one purse snatching, thirteen burglaries from vehicles, two stolen vehicles, five thefts of
motor vehicle parts, eleven incidents of vandalism, and one incident involving unlawful possession
of a weapon. The incident reports from the previous twelve months revealed similar crimes.

        ERMC also offered the expert affidavit of William Booth, the CEO of a security consulting
and investigating firm, who stated that Old Hickory Mall had a “very low level of crime for a mall
this size,” which, in his opinion, “confirm[ed] the effectiveness of the mall security program.” Mr.
Booth opined that the number of officers patrolling the mall on the date of the attack was reasonable,
considering the day, time, and size of the mall, and in fact, he stated that the “guard force” level at
the mall was equal to that used in many other larger malls with much more crime.

        In opposition to ERMC’s motion for summary judgment, Mrs. Barron argued that her attack
was foreseeable due to the number of prior criminal incidents occurring at the mall. Mrs. Barron
submitted records from the Jackson Police Department listing crimes occurring at the mall during
the four-year period prior to her attack, which included eleven robberies, three purse-snatching
incidents, four pocket-picking incidents, fifty-four larcenies from vehicles, forty-nine larcenies of
vehicle parts, thirty-three auto thefts, sixteen drug-related incidents, seven aggravated assaults, fifty
simple assaults, and five weapons incidents.

       Mrs. Barron submitted her own affidavit stating that “[she] did not feel that ERMC was
providing adequate security at the Old Hickory Mall during the months leading up to May 2004.”
She explained that ERMC was not fully enforcing the mall’s no loitering policy,2 which resulted in


         2
             The record before us does not contain any information about the mall’s “no loitering” policy. ERMC’s
Security Policy and Procedure Manual is included in the record, and it states that it applies to “the duties common to
all security organizations regardless of the site location.” Regarding loitering, the M anual reads:

         LOITERING in SHOPPING CENTERS
         Loitering is defined as remaining in an area for no particular purpose – to hang out. Centers often
         attract individuals who loiter and yet do not create disturbances.

         No one should be asked to leave unless he/she is creating a disturbance.

         A disturbance is any activity, which interferes with the operation of the center and/or causes
         customers to leave the center. Individuals engaged in such activity should be asked to stop the
         offending behavior; individuals who refuse to stop their behavior should be asked to leave the center.
                                                                                                          (continued...)


                                                          -3-
a large number of individuals loitering at the mall and a significant number of fights breaking out.
According to Mrs. Barron, the “lack of security” was discussed at nearly every one of the mall’s
regular merchants’ meetings, with store managers voicing their concerns about the fights and lack
of security. Mrs. Barron also submitted the affidavits of two store managers, who stated that there
was a problem at the mall with “kids” loitering and causing disturbances, including fights. Both
managers stated that, in their opinion, ERMC was not providing “adequate security” at the mall in
the months leading up to Mrs. Barron’s attack.

        Mrs. Barron claimed that ERMC failed to provide adequate security because there was only
one mobile security unit on patrol on the day of her attack.3 Mrs. Barron conceded that ERMC “did
not have notice of the two specific individuals who attacked [her],” but she claimed that ERMC did
have knowledge that unruly groups of young people were congregating at the mall on weekends.
Mrs. Barron claimed that if an extra security guard had been patrolling the parking lot, he might have
seen the juveniles driving away in her car, or his presence may have deterred the juveniles from
attacking her in the first place. She stated during her deposition that “on a normal day,” she thought
that ERMC utilized two mobile security units in the parking lots. Mrs. Barron claimed that ERMC
could use two mobile security units at their discretion, and that the second mobile unit should have
been used on the day of her attack because the mall was very busy due to a children’s event being
held at the mall and the fact that it was a Saturday. Mrs. Barron said that she would have expected
ERMC to utilize at least two, but possibly even four mobile security units on such a busy day. Mrs.
Barron was asked if she knew who made the decision regarding the level of security at the mall, and
she said that although she did not know, she thought that it was ERMC’s security director, Jeff
Smith.

        ERMC then filed a reply to Mrs. Barron’s response to the motion for summary judgment,
presenting an alternative argument to the effect that it owed no duty to Mrs. Barron under any
circumstance because it was not the owner of the premises where Mrs. Barron was injured. ERMC
also claimed that if Mrs. Barron’s only argument was that it should have provided “more security,”
then it should be granted summary judgment because the owner of the premises had the duty to
determine the amount of security provided, not ERMC. ERMC claimed that Mrs. Barron had failed
to explain how it could increase the level of security “beyond that which was dictated and requested


         2
          (...continued)
         The security officer should call law enforcement officers to remove an individual from the center if
         the individual fails to stop the offending behavior and/or refuses to leave when asked to do so.

         Individuals quietly enjoying the ambience of the property should not be asked to leave regardless of
         the duration of the stay.


         3
             When asked during her deposition what she thought was “wrong with the security at the mall,” Mrs. Barron
stated, “I just don’t think we had enough.” W hen asked if anything else about the security was inadequate or faulty,
she said no, and that the security officers ERMC did have were very good. In her response to ERMC’s motion for
summary judgment, however, Mrs. Barron alleged that the employee escort service was ineffective because employees
had to wait a long time for assistance, and the guards were rude and too old.


                                                         -4-
by the premises owner.” However, ERMC did not submit any evidence of its own indicating that
it was bound to provide only a certain number of mobile security units.

       On February 11, 2008, the trial court entered an order granting ERMC summary judgment,
based on the following findings:

       The court finds that under the prevailing case law, defendants, ERMC, do not have
       the duty of the owner to provide security or reasonable security measures, instead
       those duties fall clearly to the premises owner as set forth in the case of McClung v.
       Delta Square Ltd., 937 S.W.2d 891 (Tenn. 1996). The court further finds that the
       plaintiff has not allege[d] any negligence of defendants, ERMC, in providing the
       security that they provided. Instead, the plaintiff has only alleged, based upon the
       record before the court, that the defendants, ERMC, did not provide enough security
       and should have provided additional security measures. That duty, the court finds,
       under the case law, clearly falls to the owner, i.e., the mall.

The court’s order also incorporated by reference the transcript of its ruling from the bench, where
the judge stated that

       ERMC was operating under contract, contract which is not disputed under the facts
       today, that coverage would be provided for security as required by the owner, owner
       being CBL, the mall . . . .
               ....
               . . . The issue that’s been raised by the plaintiff was how much security was
       provided. They say it was inadequate. And that, again, falls on the mall, the
       business.

Mrs. Barron filed a motion to alter or amend, arguing that ERMC owed a duty to her pursuant to the
Restatement (Second) of Torts section 324A, due to the fact that ERMC had undertaken, for
consideration, the mall’s duty to provide security. In response, ERMC maintained that no one but
the business owner is under a duty to provide security. The trial court denied Mrs. Barron’s motion
to alter or amend, and Mrs. Barron timely filed a notice of appeal.

                                     II. ISSUES PRESENTED

       Mrs. Barron presents the following issue, slightly restated, for review:

       Whether the trial court erred in granting summary judgment to ERMC based on the
       court’s finding that ERMC owed no duty to Mrs. Barron.




                                                -5-
On appeal, ERMC states the issue as follows:

       Whether the trial court properly granted the Defendant’s Motion for Summary
       Judgment where the plaintiff alleged only that the defendant did not provide adequate
       security and where Tennessee law provides that only the owner of the premises has
       a duty to provide security services for the protection of a party plaintiff against the
       criminal acts of a third party.

For the following reasons, we reverse the decision of the circuit court and remand for further
proceedings.

                                   III.   STANDARD OF REVIEW

       The resolution of a motion for summary judgment is a matter of law, which we review de
novo with no presumption of correctness. Martin v. Norfolk S. Ry. Co., 271 S.W.3d 76, 84 (Tenn.
2008). However, “we are required to review the evidence in the light most favorable to the
nonmoving party and to draw all reasonable inferences favoring the nonmoving party.” Id. (citing
Staples v. CBL & Assocs., Inc., 15 S.W.3d 83, 89 (Tenn. 2000)).

       In order to establish negligence, a plaintiff must prove, among other things, “a duty of care
owed by defendant to plaintiff.” McClung v. Delta Square Ltd. P’ship, 937 S.W.2d 891, 894 (Tenn.
1996). Determining the duty that the defendant owed to the plaintiff is a question of law to be
determined by the court. Id. (citing Pittman v. Upjohn Co., 890 S.W.2d 425, 428 (Tenn. 1994);
Bradshaw v. Daniel, 854 S.W.2d 865, 869 (Tenn. 1993)).

                                          IV. DISCUSSION

        Before addressing the parties’ specific arguments regarding the existence of a duty, it would
be helpful to review the Tennessee Supreme Court’s decision in McClung. In McClung, a customer
was abducted from a shopping center parking lot and later raped and murdered. Id. at 893. The
customer’s husband filed suit against the owner and operator of the shopping center and against Wal-
Mart, one of the stores in the shopping center, alleging that they were negligent in failing to provide
security measures for the parking lot. Id. at 894.

       A duty of care is “the legal obligation owed by defendant to plaintiff to conform to a
reasonable person standard of care for protection against unreasonable risks of harm.” McClung,
937 S.W.2d at 894 (citing McCall v. Wilder, 913 S.W.2d 150, 153 (Tenn. 1995)). The Court
explained that the common law imposed no duty on anyone, except the government, to protect others
from criminal acts of unknown third persons, although merchants did have a duty to exercise
reasonable care to maintain their premises in a reasonably safe condition. Id. at 895. In 1975, the
Supreme Court had held that businesses not attracting or providing a favorable environment for
crime had no duty to protect customers unless (1) the business knew or had reason to know that
criminal acts were occurring or about to occur on the premises, which (2) posed an imminent


                                                 -6-
probability of harm to a customer. Id. at 896 (citing Cornpropst v. Sloan, 528 S.W.2d 188, 198
(Tenn. 1975)). Under that analysis, crime or conditions in the area of the defendant business were
irrelevant. Id. After reviewing numerous cases from other jurisdictions, the McClung Court
concluded that the Cornpropst rule was obsolete. Id. at 900. The Court stated, “It makes little sense
to ignore the frequency and nature of criminal activity in the immediate vicinity of the business, such
as an adjacent parking lot, if the crucial inquiry is the foreseeability of a criminal act occurring on
defendant’s premises.” Id. at 899. The Court also concluded that foreseeability of harm on which
liability may be imposed should not be limited to criminal acts of third parties that are known or
should be known to pose an imminent probability of harm to customers. Id. In other words, a
condition did not have to pose an imminent threat to persons on the premises in order to be relevant
to the foreseeability of harm. Id. The Court recognized that “[t]he criminal who intends to strike
in defendant’s parking lot will not enter defendant’s store to announce his intentions and thereby
provide defendant actual notice of the impending attack.” Id. at 902. Therefore, the Court joined
courts from other jurisdictions in imposing “a duty upon business to take reasonable measures to
protect their customers from foreseeable criminal attacks.” Id. at 899.

        The Court noted, however, that many courts disagreed on the meaning of “foreseeability” in
this context. The Court rejected the approach taken by some courts called the “prior incidents rule,”
which required a plaintiff to introduce evidence of prior incidents of crime on or near the premises
in order to establish foreseeability. Id. The Court also rejected the unpredictable “totality of the
circumstances” approach taken in other jurisdictions, which required a broad consideration of all the
circumstances surrounding the business, its location, and crime level. Id. Instead, the Court adopted
a balancing approach “consistent with our prevailing principles of fairness and justice.” Id. at 901.
Under that approach, “[a] risk is unreasonable and gives rise to a duty to act with due care if the
foreseeable probability and gravity of harm posed by defendant’s conduct outweigh the burden upon
defendant to engage in alternative conduct that would have prevented the harm.”4 Id. (citing McCall,
913 S.W.2d at 153). The Court adopted the following specific principles “to be used in determining
the duty of care owed by the owners and occupiers of business premises to customers to protect them
against the criminal acts of third parties”:

         A business ordinarily has no duty to protect customers from the criminal acts of third
         parties which occur on its premises. The business is not to be regarded as the insurer
         of the safety of its customers, and it has no absolute duty to implement security


         4
            Several factors are to be considered in deciding whether a risk is an unreasonable one, thereby giving rise
to a duty, including:

         the foreseeable probability of the harm or injury occurring; the possible magnitude of the potential
         harm or injury; the importance or social value of the activity engaged in by defendant; the usefulness
         of the conduct to defendant; the feasibility of alternative, safer conduct and the relative costs and
         burdens associated with that conduct; the relative usefulness of the safer conduct; and the relative
         safety of alternative conduct.

McClung, 937 S.W.2d at 901.


                                                          -7-
       measures for the protection of its customers. However, a duty to take reasonable
       steps to protect customers arises if the business knows, or has reason to know, either
       from what has been or should have been observed or from past experience, that
       criminal acts against its customers on its premises are reasonably foreseeable, either
       generally or at some particular time.

                In determining the duty that exists, the foreseeability of harm and the gravity
       of harm must be balanced against the commensurate burden imposed on the business
       to protect against that harm. In cases in which there is a high degree of foreseeability
       of harm and the probable harm is great, the burden imposed upon defendant may be
       substantial. Alternatively, in cases in which a lesser degree of foreseeability is
       present or the potential harm is slight, less onerous burdens may be imposed. . . . In
       short, “the degree of foreseeability needed to establish a duty decreases in proportion
       to the magnitude of the foreseeable harm” and the burden upon defendant to engage
       in alternative conduct. Pittman v. Upjohn Co., 890 S.W.2d at 433 (Tenn. 1994). “As
       the gravity of the possible harm increases, the apparent likelihood of its occurrence
       need be correspondingly less to generate a duty of precaution.” [W. Keeton, Prosser
       and Keeton on the Law of Torts § 53 at 171 (5th ed. 1984)]. The degree of
       foreseeability needed to establish a duty of reasonable care is, therefore, determined
       by considering both the magnitude of the burden to defendant in complying with the
       duty and magnitude of the foreseeable harm.

                As a practical matter, the requisite degree of foreseeability essential to
       establish a duty to protect against criminal acts will almost always require that prior
       instances of crime have occurred on or in the immediate vicinity of defendant’s
       premises. Courts must consider the location, nature, and extent of previous criminal
       activities and their similarity, proximity, or other relationship to the crime giving rise
       to the cause of action. To hold otherwise would impose an undue burden upon
       merchants.

Id. at 902 (footnote omitted). This approach, the Court explained, would appropriately address both
the economic concerns of businesses and the safety concerns of customers. Id.

        Applying these principles to the facts in McClung, the Court concluded that the attack on the
customer was foreseeable. Police records indicated that during the seventeen months prior to the
abduction, there were 164 criminal incidents occurring on or near the defendants’ parking lot,
including a bomb threat, fourteen burglaries, twelve reports of malicious mischief, ten robberies,
thirty-six auto thefts, ninety larcenies, and one attempted kidnaping in an adjacent parking lot. Id.
at 904. The Court noted that all of these crimes occurred on or in the immediate vicinity of the
defendants’ parking lot, within a relatively short period of time, and involved “a significant threat
of personal harm.” Id. The record also established that the defendants’ business was located in a
“high crime area,” and that other nearby retailers utilized security measures to protect their
customers. Id. In addition, the Wal-Mart manager testified that he would not store items outside


                                                  -8-
or hold “sidewalk sales” out of fear that merchandise would be stolen. Id. Based on the record
before it, the Court concluded that the risk of injury to the plaintiff’s wife was foreseeable. Id.

        The Court went on to note, however, that “foreseeability alone does not establish the
existence of a duty.” Id. On remand, the trial court was instructed to weigh the magnitude of the
potential harm and the burden which the duty would impose on the defendants. Id. Specifically, the
trial court was instructed to “consider whether imposing a duty to take reasonable measures to
protect patrons from the consequences of criminal acts of third persons would place an onerous
burden – economic or otherwise – upon defendants.” Id. If it did not, then the court was to consider
“whether the burden outweighs the foreseeability and gravity of the possible harm, so as to preclude
the finding of a duty to take reasonable steps to protect patrons.” Id.

        In the case before us, ERMC argues that, pursuant to McClung, “only the owner of the
premises has a duty to provide security services for the protection of a party plaintiff against the
criminal acts of a third party.” We recognize that in McClung, the Court stated that it was setting
forth principles to be used in determining the duty of care owed by “owners and occupiers of
business premises to customers.” Id. at 902. However, we disagree with ERMC’s assertion that it
therefore could not have owed a duty to Mrs. Barron under any circumstances.

         In Staples v. CBL & Associates, Inc., 15 S.W.3d 83 (Tenn. 2000), the Supreme Court
addressed the issue of duty in a case involving the same defendants named in this case. The plaintiff
had been abducted at a shopping mall and forced to drive around with her abductor until she finally
escaped. Id. at 85. The plaintiff filed suit against Proffitt’s, Inc., the store where she was shopping,
CBL & Associates, the owner of the mall, and ERMC, the company that provided security for the
mall, alleging that the defendants negligently failed to protect her and to implement and maintain an
adequate security system in the mall. Id. at 87. The trial court granted summary judgment to all
three defendants, and the Court of Appeals affirmed, finding that the defendants did not owe a duty
of care to the plaintiff because she failed to show that her abduction was foreseeable. Id. at 88.
Applying the analysis set forth in McClung, which it described as “controlling in cases dealing with
the duty of care owed by premises owners or occupiers to protect customers from the criminal acts
of third parties committed on their premises,” the Supreme Court concluded that the attack on the
plaintiff was foreseeable. Id. at 85. The plaintiff had informed two Proffitt’s employees that she was
being stalked, but they did not alert security. Id. at 90. In addition, there were 286 incidents of
crime, ranging in severity, that occurred at the mall in the fourteen months preceding the abduction.
Id. at 90, n.3. The Court emphasized that “while the number of prior criminal incidents at [the mall]
is significant in determining the existence of a duty, it is only one factor to be weighed by courts and
does not by itself establish a duty.” Id. The Court went on to find that “the gravity of the
foreseeable harm was great and that alternative conduct on the part of the defendants, which at the
least would have included calling security, was readily available and would not have unduly
burdened the defendants.” Id. at 91. Therefore, the Supreme Court held that Proffitt’s, the mall, and
ERMC owed a duty of care to the plaintiff to take reasonable steps to protect her from the abduction
that occurred. Id. at 90.



                                                  -9-
        Although the Supreme Court in Staples did not elaborate on its basis for finding that ERMC
also owed a duty to the plaintiff, it appears that ERMC would have been subject to liability pursuant
to section 324A of the Restatement (Second) of Torts, which provides:
        § 324A. Liability To Third Person For Negligent Performance Of Undertaking

         One who undertakes, gratuitously or for consideration, to render services to another
         which he should recognize as necessary for the protection of a third person or his
         things, is subject to liability to the third person for physical harm resulting from his
         failure to exercise reasonable care to protect his undertaking, if

         (a) his failure to exercise reasonable care increases the risk of such harm, or
         (b) he has undertaken to perform a duty owed by the other to the third person, or
         (c) the harm is suffered because of reliance of the other or the third person upon the
         undertaking.

(emphasis added). This section “applies specifically to parties who voluntar[ily] assume the duty
to protect others from foreseeable risk.” Collins v. Arnold, No. M2004-02513-COA-R3-CV, 2007
WL 4146025, at *14 (Tenn. Ct. App. Nov. 20, 2007) perm. app. denied (Tenn. Apr. 14, 2008).5
Similarly, in this case, if ERMC undertook, for consideration, to perform a duty owed by CBL to
third parties, which it should have recognized as necessary for the protection of third parties, ERMC
would be subject to liability to the third parties for physical harm resulting from its failure to exercise
reasonable care in its undertaking. See Restatement (Second) of Torts § 324A(b). Therefore, we
reject ERMC’s argument that it had no duty to protect Mrs. Barron under any circumstances simply
because it was not the owner or occupier of the business premises where she was injured.




         5
            Although the Supreme Court has not explicitly adopted section 324A as establishing the only situations under
which liability attaches under an assumed duty, “the Tennessee Supreme Court has quoted and applied the conditions
set out in Restatement § 324A(a)-(c) in a context indicating that those conditions establish the applicable bases for
liability when there has been a breach of the assumed duty of reasonable care.” Collins, 2007 WL 4146025, at *14.
          For example, in Biscan v. Brown, 160 S.W.3d 462, 483 (Tenn. 2005), the Court explained that the defendant,
who had assumed a duty, could be liable if any of the three conditions in section 324A were present.
          In Speaker v. Cates Co., 879 S.W.2d 811, 813 (Tenn. 1994), a landlord had hired a security company to
provide security services at an apartment complex. When analyzing the duty owed by the security company to the
apartment tenants, the Supreme Court cited section 324A and explained that “the duty of one engaged by a landlord to
carry out the landlord’s duty of care owed tenants is no greater than that of the landlord itself unless a greater duty is
assumed.” Id. at 816.
          The Middle Section of this Court, in Collins, 2007 WL 4146025, at *14, concluded that “if confronted with
the question directly, the [Supreme] Court would hold that Section 324A, including subsections (a) through (c),
establishes the law in Tennessee regarding liability under a duty that is voluntarily assumed.” Therefore, the Collins
Court held that it w as reversible error for a trial court to refuse to give a requested jury instruction based on section
324A. Id. at 15. The Supreme Court denied the application for permission to appeal filed in Collins. We agree with
the Collins Court’s conclusion that the Supreme Court would explicitly adopt section 324A if confronted with the
question directly, and we find section 324A applicable to this case.


                                                          -10-
         Next, ERMC argues that it was properly granted summary judgment because it had no duty
or ability to increase the number of mobile units, as it was contractually bound to provide the level
of security requested by the mall. Specifically, ERMC states in its brief:

         [I]t is clear from the facts that the defendant, ERMC, only provided the security
         requested and required by the owner, CBL. (R. at 110-191). They had no authority,
         as alleged by the plaintiffs and their expert, to increase the amount of security
         available . . . .

Later in its brief, ERMC describes itself as “merely a tool of the owner,” stating that it “could have
provided as much or as little security as the owner desired,” but that it was bound by the amount
requested.

         We recognize the possibility that the scope of a security company’s assumed duty, or its
ability to provide a different level of security, could be limited by its contract with the business
owner. However, ERMC simply failed to present any evidence to suggest that that is the case here.
The contract between ERMC and CBL is not included in the record before us.6 Despite many
statements and assertions made by ERMC’s counsel regarding its contractual obligations and
limitations, the only evidence in the record regarding these issues appears in Mrs. Barron’s
deposition. Mrs. Barron testified that on a “normal day,” ERMC utilized two mobile security units
for patrolling the parking lot, and because the mall was so busy on the day of the attack, she expected
that ERMC would have used at least two mobile units, possibly even four. Mrs. Barron
acknowledged that she was not exactly sure who made the decision regarding the level of security
that would be provided, but she assumed that it was ERMC’s security director, Jeff Smith. ERMC
did not present any evidence to disprove Mrs. Barron’s statements or otherwise indicate that it was
not responsible for determining the level of security to be provided in the parking lots. Although
ERMC’s brief states that it only provided “the security requested and required by the owner,” its
citation to the record, “R. at 110-191,” provides no support for this statement.7 Additionally, at oral
argument, counsel for ERMC was specifically asked about the documents in the record that would
indicate the level of security it was contractually bound to provide, and counsel referred us to its
security expert’s affidavit. However, the only relevant statement we find in ERMC’s expert report
simply states that “[t]he officers are assigned according to the traffic in the mall, an accepted practice
in mall security.” There is no evidence as to who makes the decision regarding the officers’
assignments. In short, we find no evidence in the record to support ERMC’s argument that it had



         6
            We note that the trial judge stated, when announcing his ruling from the bench, “ERMC was operating under
contract, contract which is not disputed under the facts today, that coverage would be provided for security as required
by the owner, owner being CBL, the mall . . . .” However, there is no such contract in the record, nor is there any
testimony regarding the terms of the contract.
         7
           The eighty-one pages of the record cited by ERMC’s brief include its “Statem ent of Undisputed Facts in
Support of Motion for Summary Judgment,” and Exhibits A through F, including affidavits, ERMC’s security policy
manual, and incident reports for crimes occurring at the mall.


                                                         -11-
no ability or duty to provide additional security in the parking lots due to its contract with the
business owner. Thus, ERMC was not entitled to summary judgment on that basis.

                                         V. CONCLUSION

        We reject ERMC’s arguments that it did not owe a duty to Mrs. Barron under any
circumstance either because it was not the owner of the premises or because it was contractually
bound to provide a limited level of security. As previously discussed, we find that ERMC could be
subject to liability pursuant to the Restatement (Second) of Torts section 324A by undertaking the
business owner’s duty to render services for the protection of third parties, if ERMC failed to
exercise reasonable care in its undertaking. However, ERMC’s duty would be no greater than that
of the business owner itself unless a greater duty was assumed. See Speaker v. Cates Co., 879
S.W.2d 811, 816 (Tenn. 1994). Again, there is nothing in the record before us regarding the scope
of the duty assumed by ERMC. In addition, the trial court did not address whether the business
owner would have owed a duty of care under McClung, and ERMC does not address that issue or
the issue of foreseeability on appeal. Under McClung, the analysis of whether a duty was owed by
the business owner would require consideration of whether imposing a duty would place an onerous
burden, economic or otherwise, on the defendant, and whether the burden outweighed the
foreseeability and gravity of the possible harm. See McClung, 937 S.W.2d at 904 (“[F]oreseeability
alone does not establish the existence of a duty.”). Based on the state of the record before us, we will
not address those issues.

        In sum, we will not define the extent of ERMC’s duty, if any, on appeal. We simply hold
that the trial court erred in granting summary judgment to ERMC on the basis that it owed no duty
to Mrs. Barron under any circumstances. We reverse the decision of the circuit court and remand
for further proceedings. Costs of this appeal are taxed to the appellees, Emerson Russell
Maintenance Company d/b/a ERMC, d/b/a ERMC II, L.P., d/b/a ERMC L.P.; ERMC of America,
LLC; ERMC IV, L.P.; and ERMC V, L.P., for which execution may issue if necessary.



                                                        ___________________________________
                                                        ALAN E. HIGHERS, P.J., W.S.




                                                 -12-
