— We must decide if a business owes a duty to its invitees to protect them from criminal acts by third persons on the business premises. Because a business has a special relationship with them, it has a duty to take reasonable steps to protect invitees from imminent criminal harm or reasonably foreseeable criminal conduct by third persons.
Appellant Nivens also asks us to decide if a business owes a distinct duty to invitees to retain security personnel to prevent criminal acts by third parties. Because we believe such a duty would impermissibly shift responsibility from government to private businesses to protect against criminal behavior, we hold a business does not have a separate duty to retain security personnel for the business premises to prevent criminal activity. Insofar as Nivens here specifically confined his case to the duty to provide on-premises security personnel, we affirm the summary judgment in favor of the respondents.
ISSUES
1. Does a business owe invitees a duty to prevent criminal activity by third persons on the premises that results in harm to invitees?
2. Does a business owe invitees a duty to provide on-premises security personnel to prevent criminal activity?
FACTS
On December 26, 1988, at about 10:00 p.m., Ken Nivens was assaulted by a young man who was part of a group of *195approximately a dozen young people who had been lingering in the parking lot of a 7-11/Hoagy’s Corner Store (Hoagy’s) at 40th and Bridgeport Way in Tacoma. On the evening of the assault, the store clerks took no action to disperse the crowd of youths who gathered in the parking lot.
Nivens allegedly parked his car and, as he approached the store entrance, was asked by one of the youths to buy him beer. When Nivens refused, some of the youths called him names and he was grabbed from behind. Nivens was hit in the head, neck, and shoulders, and kicked in the ribs, back, and head.
Nivens asserts that for at least six years before the assault, between 10 and sometimes as many as 100 young people would gather in the parking lot of the Hoagy’s store. Robert Figueroa, the person who assaulted Nivens, said the youths would occasionally solicit Hoagy’s customers to buy beer for them. They would then drink the beer in the Hoagy’s parking lot. A store clerk testified the youths would fight among themselves in the Hoagy’s parking lot, but she said they rarely bothered customers coming into the store. A deputy sheriff said in a declaration that loitering of the type involved in this case often includes consumption of alcohol and drugs, leading to fights and assaults. He also said the most common problem resulting from such loitering is fights or assaults.
Hoagy’s asserts the store was far more peaceful. The declaration of longtime store patron John Shadduck did not describe any acts of violence. Figueroa stated individuals had to be well behaved or they would be asked to leave. The store posted a sign stating: "no soliciting, no loitering, no loud music.” Clerk’s Papers at 14, 35, 50. Store clerk Kathleen Anderson stated the majority of teens and young adults who came to the store did not cause trouble and were well behaved. In the year she worked at the store, she never observed any fight or altercation between a customer and the people in the parking lot and no customer complaints had been received. Deputy Barnhill *196did not know of any instance of violence at the store other than the one in which Nivens was involved. Nivens did not present any evidence of other violent incidents at Hoagy’s.
In addition to signs on the premises, Hoagy’s had an explicit policy requiring clerks to ask persons drinking on the premises to dispose of any alcohol or leave. Clerks were to watch for loiterers and to tell them to leave. If they did not leave, clerks were to call the police. These policies were also articulated in two written employee manuals.
Nivens filed a complaint on June 28, 1990, alleging Hoagy’s was negligent in failing to provide adequate security on its premises, and claiming substantial injuries, including disability and disfigurement, as the result of the assault on him.
On May 15, 1992, Hoagy’s filed a motion for summary judgment, asking for dismissal of all Nivens’s claims. Hoagy’s argued that in the absence of evidence of prior violence toward customers of the store, the attack on Nivens was unforeseeable. The trial court denied this initial motion on June 15, 1992 because the foreseeability of the attack on Nivens was an issue of fact.
On February 28, 1994, just before trial, Hoagy’s moved for an order excluding expected testimony it should have hired security guards and failed to do so. The trial court granted the motion on March 4, 1994. Immediately thereafter, Nivens told the court he did not wish to proceed to trial because granting the motion in limine amounted to summary judgment for Hoagy’s. The trial court actually attempted to persuade Nivens that just because the courts have not imposed an obligation to hire security guards does not mean Hoagy’s did not breach some other duty to Nivens, stating: "I mean, obviously there are a number of other ways to deal with situations.” Report of Proceedings at 39. Counsel for Nivens nevertheless indicated he would rather appeal the trial court’s ruling than waste three or four days in trial. He then made an offer of proof in which *197he stated, "Plaintiffs claim is based solely on the failure of Defendant to hire security personnel to deal with the loitering that was going on in their parking lot premises before the timé that this assault occurred in order to correct that problem before the night of this assault.” Supplemental Report of Proceedings at 4. After listening to Nivens’s offer of proof, the trial court entered an order on summary judgment in favor of Hoagy’s, dismissing all claims, at Nivens’s invitation and with Nivens’s consent:
And the plaintiff having advised the court that the plaintiffs sole theory of recovery is that the defendant should have utilized security guards on the premises in question at certain times in order to stop or control the loitering that was occurring on the premises before and including the evening during which the plaintiff was allegedly assaulted on the defendant’s premises;
And the plaintiff electing not to proceed to trial upon any other theory of recovery at this time; now, therefore, it is hereby
ORDERED that judgment is GRANTED in favor of Defendant Southland Corporation d/b/a 7-Eleven Hoagy’s Corner, dismissing the plaintiff’s claims against the defendant with prejudice.
Clerk’s Papers at 271-73. The Court of Appeals affirmed the trial court, Nivens v. 7-11 Hoagy’s Corner, 83 Wn. App. 33, 53, 920 P.2d 241 (1996), stating there was "a dearth of evidence to support a finding that a reasonable person would have foreseen violence of the general type that occurred here, and neither the evidence nor inferences therefrom is sufficient to bring the store within the obligated class.” We granted review.
ANALYSIS
In reviewing a grant of summary judgment, an appellate court engages in the same inquiry as the trial court. Degel v. Majestic Mobile Manor, Inc., 129 Wn.2d 43, 48, 914 P.2d 728 (1996). A summary judgment is appropri*198ate "if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law.” CR 56(c). The facts and all reasonable inferences therefrom must be considered in the light most favorable to the nonmoving party. Degel, 129 Wn.2d at 48. We review questions of law de novo. Barr v. Day, 124 Wn.2d 318, 324, 879 P.2d 912 (1994).
As in any negligence case, the plaintiff must prove duty, breach, causation, and damages. Hansen v. Friend, 118 Wn.2d 476, 479, 824 P.2d 483 (1992). The central issue in this case is whether, as a matter of law, Hoagy’s had a duty to Nivens. Degel, 129 Wn.2d at 48.
A. The Duty to Protect Business Invitees From the Criminal Acts of Third Persons
Washington courts have attempted to address the duty owed by business owners to their invitees to protect them from harm on the business premises. In the case of physical danger on the business premises, Washington courts have held a business owner owes a duty to invitees to protect them from dangerous conditions on the premises. See, e.g., Degel, 129 Wn.2d at 49 (the landowner owes to invitees an affirmative duty to use ordinary care to keep the premises in a reasonably safe condition); Tincani v. Inland Empire Zoological Soc’y, 124 Wn.2d 121, 139, 875 P.2d 621 (1994) ("In limited circumstances, Restatement (Second) of Torts § 343A creates a duty to protect invitees even from known or obvious dangers. This occurs when a possessor 'should anticipate the harm despite such knowledge or obviousness.’ ’0.1
While our law of premises liability for physical hazards *199is well developed, Washington law on the liability of business owners for hazards created by the conduct of people, particularly criminal conduct, is less well established. Although a number of our cases address the duty owed by a business to an invitee with respect to criminal behavior by third persons in particularized, special circumstances, we have never said a general duty exists running from all businesses to all invitees.
B. The Duty at Common Law
At common law, there was no duty to protect people in general from the criminal acts of third persons: "The general rule at common law is that a private person does not have a duty to protect others from the criminal acts of third parties.” Hutchins v. 1001 Fourth Ave. Assocs., 116 Wn.2d 217, 223, 802 P.2d 1360 (1991) (citing E.L. Kellett, Annotation, Private Person’s Duty and Liability for Failure to Protect Another Against Criminal Attack by Third Person, 10 A.L.R. 3d 619, § 3 (1966)); accord Bartlett v. Hantover, 9 Wn. App. 614, 620, 513 P.2d 844 (1973) ("As a general proposition, one citizen does not owe a duty to another citizen to protect the other against the criminal acts of a third person.”) (citing William L. Prosser, The Law of Torts § 33 (4th ed. 1971)), rev’d on other grounds, 84 Wn.2d 426, 526 P.2d 1217 (1974). See also Restatement (Second) of Torts § 315.
In Hutchins v. 1001 Fourth Ave. Assocs., 116 Wn.2d 217, 802 P.2d 1360 (1991), we addressed the duty of a landowner to provide security measures to protect a passerby from the risk of criminal behavior on the premises. In that case, the plaintiff, while returning to his hotel in downtown Seattle, was accosted by a stranger, pushed into *200an armored car bay on the defendant’s premises, and beaten and robbed by the stranger and an accomplice. We discussed both premises liability and the duty of a person to protect others from third party criminal conduct and found no duty owed under the facts of that case:
[W]e hold that a possessor of land has no generalized duty to provide security measures on the premises so as to protect those off the premises, including passersby, from third party criminal activity on the premises. There may be an exception in the case of third party criminal actors invited or permitted on the land, and perhaps an exception in the case of known criminal activity by trespassers on the property, though we do not decide these issues here. There may be a further exception which will apply where defendant’s construction or maintenance of the premises brings about a special or peculiar temptation or opportunity for criminal misconduct affecting those off the premises. Again, we do not conclusively define the parameters of any such duty.
Id. at 233.
C. Exceptions to the Common Law — Special Relationships
As we noted in Hutchins, a duty may arise to protect others from third party criminal conduct if a special relationship exists between the defendant, the third party, or the third party’s victim. Id. at 227-28. The Restatement (Second) op Torts § 315 states:
There is no duty so to control the conduct of a third person as to prevent him from causing physical harm to another unless
(a) a special relation exists between the actor and the third person which imposes a duty upon the actor to control the third person’s conduct, or
(b) a special relation exists between the actor and the other which gives to the other a right to protection.
We specifically adopted § 315 in Peterson v. State, 100 *201Wn.2d 421, 671 P.2d 230 (1983), in a case where we decided the special relationship between a psychotherapist and patient created a duty by the therapist to persons injured by the patient who was improperly released from a state hospital. Recently, in Niece v. Elmview Group Home, 131 Wn.2d 39, 50, 929 P.2d 420 (1997), we again recognized that a duty to protect another person from the criminal acts of third parties may arise where a person is entrusted with the care of another. In Niece, we held the defendant institution liable for the sexual assault of its staff person upon a resident because it was entrusted with the resident’s well being. See also Gurren v. Casperson, 147 Wash. 257, 259, 265 P. 472 (1928) (hotel has duty to protect guests against violent acts of other guests when guest has specifically warned hotel of possibility of assault; reflection of special relationship of innkeeper to guest).
In this case, we must determine if the relationship between a business and a business invitee is a special relationship. Washington law has recognized a special relationship in a variety of factual circumstances, including common carrier and passenger (Benjamin v. City of Seattle, 74 Wn.2d 832, 833, 447 P.2d 172 (1978) (common carrier owes the highest degree of care to its passengers)); employer and employee (Bartlett v. Hantover, 9 Wn. App. 614, 621, 513 P.2d 844 (1973) (employer has a duty to make reasonable provision against foreseeable dangers of criminal misconduct to which the employment exposes the employee), rev’d on other grounds, 84 Wn.2d 426, 526 P.2d 1217 (1974)); psychotherapist and patient {Peterson, supra); hospital and patient (Byerly v. Madsen, 41 Wn. App. 495, 503, 704 P.2d 1236 (1985) (hospital owes an independent duty of care to its patients)); innkeeper and guest (Miller v. Staton, 58 Wn.2d 879, 883, 365 P.2d 333 (1961)); and school and student (McLeod v. Grant County Sch. Dist. No. 128, 42 Wn.2d 316, 319-22, 255 P.2d 360 (1953)). In Lauritzen v. Lauritzen, 74 Wn. App. 432, 874 P.2d 861, review denied, 125 Wn.2d 1006, 886 P.2d 1134 (1994), the Court of Appeals declined to discern a special relationship between a driver and passenger who were husband and wife such *202that the wife could sue the husband for exposing her to criminal acts of third persons while driving in Florida. The Court of Appeals there emphasized the "entrustment aspect” between the parties creates the special relationship the common law recognizes. Id. at 440-41.
Our cases have implied that the relationship between a business and an invitee is a special relationship. In Niece, we reviewed the situations in which Washington courts have recognized special relationships and suggested the relationship of a business establishment to a customer is such a special relationship. Niece, 131 Wn.2d at 44. Similarly, in Hutchins, we noted that at common law a special relationship existed between business establishments and customers. Id. at 228 (citing W. Page Keeton et al., Prosser and Keeton on the Law op Torts § 56, at 383 (5th ed. 1984)).
What we have impliedly recognized in earlier cases, we now explicitly hold: a special relationship exists between a business and an invitee because the invitee enters the business premises for the economic benefit of the business. As with physical hazards on the premises, the invitee entrusts himself or herself to the control of the business owner over the premises and to the conduct of others on the premises. Such a special relationship is consistent with general common-law principles.* 12 34We discern no reason not to extend the duty of business owners to invitees *203to keep their premises reasonably free of physically dangerous conditions in situations in which business invitees may be harmed by third persons.
D. The Nature of the Duty
Having determined that a special relationship exists between a business and an invitee so that the general common-law rule that a person owes no duty to protect others from criminal acts of third persons does not apply, we turn next to the affirmative duty that is owed by the business to the invitee. In the absence of a clear articulation of the business’s duty, the business could become the guarantor of the invitee’s safety from all third party conduct on the business premises. This is too expansive a duty. The Court of Appeals in Passovoy v. Nordstrom, Inc., 52 Wn. App. 166, 172-73, 758 P.2d 524 (1988), review denied, 112 Wn.2d 1001 (1989), a case in which the plaintiff was injured by shoplifters fleeing from store detectives, adopted the Restatement (Second) Op Torts § 344 (1965), with respect to a business’s duty to warn others to avoid harm; the Restatement § 344 indicates:
A possessor of land who holds it open to the public for entry for his business purposes is subject to liability to members of the public while they are upon the land for such *204a purpose, for physical harm caused by the accidental, negligent, or intentionally harmful acts of third persons or animals, and by the failure of the possessor to exercise reasonable care to
(a) discover that such acts are being done or are likely to be done, or
(b) give a warning adequate to enable the visitors to avoid the harm, or otherwise to protect them against it.
The Court of Appeals below likewise adopted this section for the duty owed by a business to an invitee with respect to criminal conduct. Nivens, 83 Wn. App. at 46.
We believe the Restatement (Second) Of Torts § 344 is consistent with and a natural extension of Washington law and properly delimits the duty of the business to an invitee. We expressly adopt it for a business owner and business invitees. Comments (d) and (f) to that section describe the limit of the duty owed:
A public utility or other possessor of land who holds it open to the public for entry for his business purposes is not an insurer of the safety of such visitors against the acts of third persons, or the acts of animals. He is, however, under a duty to exercise reasonable care to give them protection. In many cases a warning is sufficient care if the possessor reasonably believes that it will be enough to enable the visitor to avoid the harm, or protect himself against it. There are, however, many situations in which the possessor cannot reasonably assume that a warning will be sufficient. He is then required to exercise reasonable care to use such means of protection as are available, or to provide such means in advance because of the likelihood that third persons, or animals, may conduct themselves in a manner which will endanger the safety of the visitor. . . . Since the possessor is not an insurer of the visitor’s safety, he is ordinarily under no duty to exercise any care until he knows or has reason to know that the acts of the third person are occurring, or are about to occur. He may, however, know or have reason to know, from past experience, that there is a likelihood of conduct on the part of third persons in general which is likely to endanger the safety of the *205visitor, even though he has no reason to expect it on the part of any particular individual. If the place or character of his business, or his past experience, is such that he should reasonably anticipate careless or criminal conduct on the part of third persons, either generally or at some particular time, he may be under a duty to take precautions against it, and to provide a reasonably sufficient number of servants to afford a reasonable protection.
(Emphasis added.)
In summary, because of the special relationship that exists between a business and business invitee, we hold a business owes a duty to its invitees to protect them from imminent criminal harm and reasonably foreseeable criminal conduct by third persons. The business owner must take reasonable steps to prevent such harm in order to satisfy the duty.
Our recognition of a duty does not end the present inquiry, however. No duty arises unless the harm to the invitee by third persons is foreseeable. Foreseeability is ordinarily a fact question. Hansen, 118 Wn.2d at 483. We do not undertake an analysis of the foreseeability of Nivens’ injury here because Nivens did not base his case on a general duty of a business to an invitee.3
E. No Duty to Provide Security Personnel
As the colloquy between Nivens’s counsel and the trial court amply demonstrated, Nivens abandoned any argument of duty based on the special relationship between business and invitee, arguing instead a business generally owes a duty to provide security personnel to prevent criminal behavior on the business premises. We decline to find such a duty. To do so would unfairly shift *206the responsibility for policing, and the attendant costs, from government to the private sector. As the Michigan Supreme Court stated in Williams v. Cunningham Drug Stores, Inc., 429 Mich. 495, 418 N.W.2d 381, 384-85 (1988):
We agree with the Court of Appeals that a merchant’s duty of reasonable care does not include providing armed, visible security guards to deter criminal acts of third parties. We decline to extend defendant’s duty that far in light of the degree of control in a merchant’s relationship with invitees, the nature of the harm involved, and the public interest in imposing such a duty.
The duty advanced by the plaintiffs is essentially a duty to provide police protection. That duty, however, is vested in the government by constitution and statute. ... To require defendant to provide armed, visible security guards to protect invitees from criminal acts in a place of business open to the general public would require the defendant to provide a safer environment on his premises than his invitees would encounter in the community at large. Defendant simply does not have that degree of control and is not an insurer of the safety of his invitees. . . . The inability of government and law enforcement officials to prevent criminal attacks does not justify transferring the responsibility to a business owner such as defendant. To shift the duty of police protection from the government to the private sector would amount to advocating that members of the public resort to self-help. Such a proposition contravenes public policy.
See also Boren v. Worthen Nat’l Bank, 324 Ark. 416, 921 S.W.2d 934 (1996). While in certain circumstances the duty arising out of the special relationship between a business and an invitee described by § 344 of the Restatement may best be met by providing security personnel as part of the reasonable steps to forestall harm to invitees, Ann M. v. Pacific Plaza Shopping Ctr., 6 Cal. 4th 666, 863 P.2d 207, 25 Cal. Rptr. 2d 137, 145-46 (1993), we decline to hold such a duty always obtains as a distinct duty of care.
In this case, Nivens argued to the trial court that the granting of the motion in limine to exclude evidence of se*207curity guards was tantamount to dismissing his case. Indeed, Nivens argued for a distinct duty on the part of business owners to provide on-premises security guards. As we do not recognize such a separate duty, the summary judgment in favor of Hoagy’s must be affirmed.
CONCLUSION
The general common-law rule is a person owes no duty to protect another from the criminal acts of third persons. The common law recognizes an exception to the general rule, however: there is a duty to protect another from the criminal acts of third persons when a special relationship is present. A special relationship exists between a business and its invitees so that the business has a duty to take reasonable steps to prevent harm to its invitees from the acts of third parties on the premises, if such acts involve imminent criminal conduct or reasonably foreseeable criminal behavior. Here, given Nivens’s decision to rely on a distinct duty for businesses to provide security personnel to protect invitees from harmful conduct by third persons, a duty we decline to recognize, the trial court correctly dismissed Nivens’ action.
We affirm.
Durham, C.J., and Dolliver, Smith, Guy, Madsen, and Alexander, JJ., concur.
"The legal duty owed by a landowner to a person entering the premises depends on whether the entrant falls under the common law category of a trespasser, licensee, or invitee.” Iwai v. State, 129 Wn.2d 84, 90-91, 915 P.2d 1089 (1996). The highest duty of the three levels toward persons entering the premises of the owner or occupier of land attaches to invitees. Johnson v. State, *19977 Wn. App. 934, 940, 894 P.2d 1366, review denied, 127 Wn.2d 1020, 904 P.2d 299 (1995). Hoagy’s does not dispute that Nivens was a business invitee. The Court has adopted the Restatement (Second) of Torts § 332 (1965) definition of invitee: an invitee, as a business visitor, is a person who is invited to enter or remain on land for a purpose directly or indirectly connected with business dealings with the possessor of the land. Younce v. Ferguson, 106 Wn.2d 658, 667, 724 P.2d 991 (1986).
Restatement (Second) Of Torts § 314A (1965) lists examples of special relationships:
(1) A common carrier is under a duty to its passengers to take reasonable action
(a) to protect them against unreasonable risk of physical harm, and
(b) to give them first aid after it knows or has reason to know that they are ill or injured, and to care for them until they can be cared for by others.
(2) An innkeeper is under a similar duty to his guests.
(3) A possessor of land who holds it open to the public is under a similar duty to members of the public who enter in response to his invitation.
(4) One who is required by law to take or who voluntarily takes the custody of another under circumstances such as to deprive the other of his normal opportunities for protection is under a similar duty to the other.
*203(Emphasis added.) The only Washington cases to have cited this section focused on the duty to prevent harm to someone in custody. See, e.g., Hansen v. Horn Rapids O.R.V. Park, 85 Wn. App. 424, 932 P.2d 724 (1997). But other states have applied this section to the business customer relationship. An example of the application of this section appears in Southland Corp. v. Griffith, 332 Md. 704, 633 A.2d 84 (1993), a case with facts remarkably similar to the present case. There, a plaintiff sought to recover damages for injuries he received when he was assaulted in the parking lot of a 7-11 store. Although the store clerk was informed of the altercation taking place on his premises, he refused to telephone the police, even after repeatedly having been requested to summon assistance. The Maryland Court of Appeals adopted § 314A of the Restatement (Second) Of Torts in holding
that an employee of a business has a legal duty to take affirmative action for the aid or protection of a business invitee who is in danger while on the business’s premises, provided that the employee has knowledge of the injured invitee and the employee is not in the path of danger.
Southland Corp., 633 A.2d at 91.
Washington courts have been reluctant to find criminal conduct foreseeable. See, e.g., Jones v. Leon, 3 Wn. App. 916, 926, 478 P.2d 778 (1970) (criminal act "was so highly extraordinary or improbable as to be wholly beyond the range of expectability”); Shelby v. Keck, 85 Wn.2d 911, 541 P.2d 365 (1975) (defendant’s criminal act was not reasonably foreseeable by liquor licensee); Christen v. Lee, 113 Wn.2d 479, 496, 780 P.2d 1307 (1989) (criminal assault not a foreseeable consequence of furnishing intoxicating liquor).