Commission Implementing Regulation (EU) 2018/574 of 15 December 2017 on technical standards for the establishment and operation of a traceability system for tobacco products (Text with EEA relevance. )

Article 36

Security and interoperability of communications and data

• (a) the ID issuer for communications between the ID issuer, the operators of the first retail outlets and the economic operators registering with the ID issuer or requesting unique identifiers;

• (b) the providers of the primary repositories for communications between the primary repositories and manufactures or importers;

• (c) the provider of the secondary repository for communications between the secondary repository and the router and:
• i. the ID issuers;
• ii. the primary repositories; and
• iii. economic operators using the router, i.e. economic operators other than manufacturers and importers.

Article 36a

Quality of data

Article 37

Transitional provision

Article 38

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

ANNEX I

SELECTION PROCEDURE FOR INDEPENDENT THIRD PARTY PROVIDERS OF REPOSITORY SYSTEMS

PART A

The following procedures shall apply to the selection of an independent third party provider operating a primary repository:

• 1. Each manufacturer and importer of cigarettes and roll-your-own tobacco shall notify to the Commission, no later than two months following the entry into force of Delegated Regulation (EU) 2018/573:
• (a) the identity of the third party that it proposes to appoint to operate a primary repository (the ‘proposed provider’), and
• (b) a draft data storage contract containing the key elements laid down in the Delegated Regulation for approval by the Commission.

• 1a. Where several legal persons constitute the same manufacturer or importer, the notification shall be submitted jointly by all legal persons.

• 1b. In cases where the importer concerned cooperates with only one non-EU manufacturer or belongs to the same group of companies as the latter, the data storage contract may be co-signed by both the importer and the non-EU manufacturer. In cases where the importer concerned cooperates with several non-EU manufacturers or is also a Union manufacturer itself, the data storage contract shall be signed solely by the importer.

• 1. The notification shall be accompanied by:
• (a) the written declaration of technical and operational expertise, referred to in Article 4 of Delegated Regulation (EU) 2018/573,
• (b) the written declaration of legal and financial independence, referred to in Article 8 of Delegated Regulation (EU) 2018/573, and
• (c) a table setting out the correspondence between the contractual clauses and the requirements laid down in Delegated Regulation (EU) 2018/573.

• 1. The Commission shall, within three months of the date of receiving the notification, and on the basis of an examination of the suitability of the proposed provider, in particular, as regards its independence and technical capacities as referred to in Article 15(8) of Directive 2014/40/EU, approve or reject the proposed provider and the draft contract. In the absence of a reply by the Commission within that timeframe, the provider and the draft contract shall be deemed to be approved.

• 1. Where the Commission does not approve the proposed provider or the draft contract, or where it considers that the contract does not incorporate the key elements laid down in Delegated Regulation (EU) 2018/573, the manufacturer or importer concerned shall, within one month of being informed by the Commission, propose an alternative provider and/or make necessary amendments to the draft contract for further consideration by the Commission.

• 1. Once the proposed provider and the draft contract have been approved, the manufacturers and importers shall, within two weeks of such approval, provide in electronic format:
• (a) a copy of the contract signed by both parties, and
• (b) the declarations required to be provided as part of the contract under Articles 4 and 8 of Delegated Regulation (EU) 2018/573.

• 1. Manufacturers and importers of tobacco products other than cigarettes and roll-your-own tobacco shall notify to the Commission, by 31 December 2022, the identity of the proposed provider, a draft data storage contract containing the key elements laid down in Delegated Regulation (EU) 2018/573 for approval by the Commission, and the additional documentation referred to in paragraph 2.

• 1. The provider appointed to operate the primary repository shall only integrate its repository into the traceability system following the conclusion of the approved contract.

• 1. A list of notified and approved third parties shall be made publicly available by the Commission on a website.

• 1. Any amendment to the key elements of the contract, as defined in Delegated Regulation (EU) 2018/573, shall be subject to approval by the Commission. In the absence of a reply by the Commission within three months of the date of notification of the amendment, the amendment shall be deemed to be approved. This deadline can be extended by the Commission once by a maximum of another three months, by means of a letter to the notifying operator. Any other amendment to the contract than to its key elements shall only require prior communication to the Commission.

PART B

The following procedure shall apply to the selection of an independent third party operating the secondary repository system:

• 1. The Commission shall appoint, from amongst the providers of the primary repositories who have been approved in accordance with Part A  within six months following the entry into force of Delegated Regulation (EU) 2018/573, a provider tasked with operating the secondary repository (‘the operator of the secondary repository’) for the purpose of carrying out the services specified in Chapter V of this Regulation.

• 1. The appointment of the operator of the secondary repository shall be based on an assessment of objective criteria and take place by means of a concession contract concluded in writing between the Commission and each successive operator of the secondary repository.

• 1. The result of the appointment of the operator of the secondary repository shall be made publicly available by the Commission on a website.

• 1. Each primary repository provider appointed in accordance with Part A shall enter into an individual contract with the provider appointed to operate the secondary repository for the purpose of carrying out the services specified in Chapter V of this Regulation.

• 1. The contracts between each primary repository provider and the operator of the secondary repository shall be signed and submitted to the Commission within three monthsfrom the date of the appointment of each successive operator of the secondary repository.

PART C

The following requirements shall apply in addition to the selection procedures outlined in Parts A and B:

• 1. Where the contractual relationship between a manufacturer or importer and the provider of a primary repository is terminated, or expected to be terminated, by any of the parties to the contract, for any reason, including the failure to comply with the criteria for independence laid down in Article 35, the manufacturer or importer shall immediately inform the Commission of such termination, or expected termination, and of the date of the notification of such termination to the provider, as well as the date at which the termination is or is expected to take effect. The manufacturer or importer shall propose and notify to the Commission a replacement provider at the latest three months prior to the termination date of the existing contract. The appointment of the replacement provider shall take place in accordance with Part A.

• 1. In the event that the operator of the secondary repository gives notice of its intention to cease operating that repository in accordance with the concession contract referred to in paragraph 2 of Part B, it shall immediately inform the Commission thereof and of the date at which the termination is to take effect. The notice period shall not be shorter than nine months. The contract shall provide for the Commission to be able to unilaterally extend it by up to six months if required for establishing and operationalising a replacement operator of the secondary repository. The Commission shall inform the competent authorities of the Member States about the notice period and its potential extension.

• 1. Where paragraph 1 applies, the contract referred to in paragraph 4 of Part B shall, in turn, be terminated by the parties immediately after the closure of the affected primary repository.

ANNEX II

Key messages to be sent by the economic operators

The messages required for regulatory purposes shall contain at least the data fields listed in this Annex.

Member States and the Commission may require an extension of the address data to include exact geographic coordinates (latitude and longitude). Both ID issuers and providers of data repositories (including the router) may decide to extend the message content for strictly technical reasons to secure smooth functioning of the traceability system. ID issuers may also decide to extend the message content for non-technical reasons to secure smooth functioning of the tobacco products traceability system with other systems used for regulatory purposes. Before becoming effective, such extensions shall be reflected in the technical specifications updated in accordance with Article 28.

The messages listed in this Annex do not include the messages to be sent back by ID issuers and providers of data repositories (including the router) to the economic operators, such as acknowledgments of receipt.

All the messages generated within the traceability system shall contain the identification of the message originator and a timestamp up to the millisecond (see Data Type: Time(L)). This timestamp does not replace the time of the occurrence of a reported event, which shall be reported separately in accordance with the data fields prescribed in this Annex. The identification of the message originator, which may concern a third-party IT service provider, does not replace the identification of the economic operator responsible for the reporting activity (via an EOID to be indicated in the EO_ID field). The means of the identification of the message originator shall be specified in the technical specifications established and updated in accordance with Article 28.

ID issuers and providers of data repositories (including the router) shall timestamp each received message up to the millisecond.

In case of amendments to this Annex, any changes in the key messages listed herein become applicable to the economic operators as of the moment such changes are duly reflected in the technical specifications and the common data dictionary established and updated in accordance with Article 28.

CHAPTER I

FIELD DESCRIPTIONS

SECTION 1

Data Type

SECTION 2

Cardinality Type

SECTION 3

Priority Type

CHAPTER II

MESSAGES

SECTION 1

Identifier codes for economic operators, facilities and machines

1.1.   Request for an economic operator identifier code

1.2.   Correction of information concerning the economic operator identifier code

1.3.   De-registration of economic operator identifier code

1.4.   Request for a facility identifier code

1.5.   Correction of information concerning the facility identifier code

1.6.   De-registration of facility identifier code

1.7.   Request for a machine identifier code

1.8.   Correction of information concerning the machine identifier code

1.9.   De-registration of machine identifier code

SECTION 2

Unique identifiers (UIs)

2.1.   Request for unit level UIs

2.2.   Request for aggregated level UIs

2.3.   Request for deactivation of UIs

2.4.   Request for reactivation of UIs for products reported as stolen but recovered (only permitted if in preceding message type 2-3, field Deact_Reason1 = 2)

SECTION 3

Recording and transmission of information on product movements

3.1.   Application of unit level UIs on unit packets

3.2.   Application of aggregated level UIs on aggregated packaging

3.3.   Dispatch of tobacco products from a facility

3.4.   Arrival of tobacco products at a facility

3.5.   Trans-loading

3.6.   Disaggregation of aggregated level UIs

3.7.   Report of delivery carried out with a vending van to retail outlet (required if in message type 3-3, field Destination_ID1 = 4)

3.8.   Dispatch of tobacco products from a facility to laboratories, waste disposal centres, national authorities, international governmental organisations, embassies and military bases

SECTION 4

Transactional events

4.1.   Issuing of the invoice

4.2.   Issuing of the order number

4.3.   Receipt of the payment

SECTION 5

Recalls

5. Recalls of requests, operational and transactional messages (possible for message types 2-1, 2-2, 2-3 (only within 24 hours from the original reporting of message 2-3, for Deact_Reason1 other than ‘2 – Product stolen’), 3-1 to 3-8, 4-1, 4-2 and 4-3)

ANNEX III

Structure of a unit-level unique identifier