COMMISSION IMPLEMENTING REGULATION (EU) …/...
of XXX
on technical standards for the establishment and operation of a traceability system for tobacco products
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Directive 2014/40/EU of the European Parliament and of the Council of 3 April 2014 on the approximation of the laws, regulations and administrative provisions of the Member States concerning the manufacture, presentation and sale of tobacco and related products and repealing Directive 2001/37/EC, and in particular Article 15(11) thereof,
Whereas:
(1)In order to address the issue of illicit trade in tobacco products, Directive 2014/40/EU provides that all unit packets of tobacco products are to be marked with a unique identifier and their movements tracked and traced throughout the Union. Technical specifications regarding the system's establishment and operation, as well as its compatibility throughout the Union, should be laid down.
(2)Rules concerning the marking of packages with a unique identifier, the recording and transmission of data, the processing, storing and accessing of data and the compatibility of components of the traceability system should be set.
(3)Legislative action at Union level is also necessary in order to implement Article 8 of the Protocol to Eliminate Illicit Trade in Tobacco Products to the World Health Organisation's Framework Convention on Tobacco Control ('WHO FCTC Protocol'), which has been ratified by the European Union and provides for a global tracking and tracing regime for tobacco products, to be established by the Parties to the WHO FCTC Protocol within five years of its entry into force.
(4)In order to combat multiple existing types of fraudulent activities that result in illicit products being made available to consumers, including practices that entail the false declaration of exports, the traceability system provided for under this Regulation is to apply, in accordance with Article 15 of Directive 2014/40/EU, to all tobacco products manufactured in the Union, as well as to those manufactured outside the Union insofar as they are destined for or placed on the Union market.
(5)In order to provide for the independence of the traceability system and guarantee that it is controlled by the Member States, as provided under Article 8 of the WHO FCTC Protocol, a proper assignment of roles in relation to the marking of packages with a unique identifier is essential. The key task of generation of the unique identifiers, at both unit packet and aggregated packaging level, should be attributed to an independent third party appointed by the Member States ('ID issuer').
(6)To avoid the risk that two or more ID issuers, independently of each other, generate the same unique identifier, each ID issuer should be identified by a unique identification code, which should also form part of the unique identifiers issued by them.
(7)In order to guarantee the uniqueness of the identifier, a serial number generated by the ID issuer having a negligible probability to be guessed by falsifiers should form part of each unique identifier.
(8)When requesting unit packet unique identifiers from an ID issuer, manufacturers and importers should be required to provide all information necessary for the issuer to be able to generate that identifier, in accordance with Article 15(2), points (a) to (h) of Directive 2014/40/EU, with the exception of date and time of manufacture, which may not be possible to determine in advance and which should be added by economic operators at the moment of production.
(9)The length of the unit level unique identifier may impact the speed at which it can be applied to unit packets by tobacco product manufacturers or importers. In order to avoid an excessive impact on this process whilst ensuring sufficient space for all information required at unit packet level, the maximum permitted number of alphanumeric characters for the unit level unique identifier should be laid down.
(10)In order to ensure that unit level unique identifiers are capable of meeting the requirements relating to the maximum permitted number of alphanumeric characters, information required under Article 15(2) points (a) to (h) of Directive 2014/40/EU should be translated into code.
(11)For the purpose of decoding the unique identifiers by the competent authorities of the Member States without accessing the information stored in the repository system, flat-files should be established and maintained by the ID issuers. Such flat-files should enable all information codified in the unique identifier codes to be identified. The size of such flat-files should be defined, in order to ensure that they can be downloaded to the devices used by Member States when reading the unique identifiers in offline mode (offline flat-files).
(12)Directive 2014/40/EU provides that the recording obligations established pursuant to Article 15 may be complied with by the marking and recording of aggregated packaging, such as cartons, mastercases or pallets, provided that the tracking and tracing of all unit packets remains possible. To allow for this, it is necessary for all aggregated packaging to be marked with an aggregated level identifier which is also unique and therefore capable of unequivocally identifying the unit packets that it contains. For this reason, aggregated level unique identifiers should be generated by the ID issuers and contain the ID issuer identification code as well as a serial number.
(13)In order to determine the minimum essential information related to aggregation in offline mode, the aggregated level unique identifier should also include the location and time of the aggregation.
(14)In order to ensure that all movements of the unit packets can be recorded and transmitted, manufacturers and importers should verify the unique identifiers so as to ensure their readability. To control this critical process for the unit level unique identifiers, anti-tampering devices, which are to be supplied by an independent third party, should be installed on the devices used for verification purposes.
(15)In order to minimise the impact of the traceability system on production and distribution schemes, economic operators should be permitted to order batches of the unique identifiers in advance. However, to avoid overstocking of the unique identifiers by economic operators and to control the size of individual orders, a time limit for the application of unique identifiers at both unit packet and aggregated levels should be set. These measures should also alleviate potential excessive impacts on the generation and issuing activities performed by the ID issuers.
(16)In order to ensure the proper functioning of the traceability system, economic operators and operators of retail outlets should apply in advance to the relevant ID issuers for an economic operator identification code and for a facility identifier code for each facility. The assignment of economic operator identification codes and facility identifier codes permits the efficient identification of all purchasers and of the actual shipment route from manufacturing to the first retail outlet as provided for in Article 15(2) points (i) and (j) of Directive 2014/40/EU.
(17)Manufacturers or importers should in addition apply for an identifier code for the machine used to manufacture tobacco products. The obligation to apply for machine identification codes permits the efficient identification of the machine used to manufacture the tobacco products in accordance with Article 15(2) point (c) of Directive 2014/40/EU.
(18)To ensure that the information contained in the unique identifier is capable of being recorded and transmitted by all relevant economic operators, as well as to guarantee the compatibility of the unique identifier with external components such as scanning devices, a list of permitted data carriers should be established.
(19)In order for the traceability system to be able to achieve its objective, it is necessary for it to be capable of enabling easy transmission of all relevant data, providing secure storage of data and ensuring full access to this data for the Commission, the competent authorities of the Member States and the external auditor. The storage architecture should further allow manufacturers and importers to select independent third party data storage providers (‘primary repositories’) with which to conclude data storage contracts, as provided for by Article 15(8) of Directive 2014/40/EU, whilst ensuring authorities are provided with full access to all stored data for the purpose of carrying out their monitoring and enforcement activities. The effectiveness of such monitoring and enforcement activities requires the presence of a single second-level repository system (‘secondary repository’), containing a copy of all the data stored in the primary repositories and providing authorities with a global overview of the functioning of the traceability system. A routing system, operated by the provider of the secondary repository, should be established in order to provide economic operators other than manufacturers and importers with a single entry point to submit the data recorded by them to the traceability system and thereby ease the data transmission. At the same time, the routing service should ensure that data are transmitted to the correct primary repository.
(20)In order to guarantee full access for relevant authorities and to contribute to the efficient functioning of the traceability system, the provider of the secondary repository should develop user interfaces enabling the stored data to be viewed and queried. In using the traceability system the relevant authorities should be able to rely on the eIDAS based reusable solutions provided as building blocks under the telecommunication part of the Connecting Europe Facility. In addition, to facilitate effective surveillance and enforcement, the user interface should include automatic alerts based on specific reporting events.
(21)To ensure interoperability of the components of the repository system, technical specifications should be established for the exchange of data between the primary repositories, the secondary repository and the routing system.
(22)In order to ensure that the required information is recorded and transmitted in a timely and uniform manner by all economic operators, the precise list of supply chain and transactional events that are required to be recorded under Article 15(2), points (i), (j) and (k) of Directive 2014/40/EU, as well as the content of the information messages to be transmitted, should be laid down.
(23)Given that the aim of a traceability system is to provide Member States and the Commission with an effective tool to fight illicit trade of tobacco products, timely availability of supply chain and transactional event data is necessary for investigation and enforcement purposes. The maximum time that may elapse between the occurrence of a relevant supply chain or transactional event and the transmission of the related information to the relevant data storage repository should therefore be established.
(24)Given the requirement for the traceability system to be independent and controlled by the Member States, as provided for under Article 8 of the WHO FCTC Protocol, common criteria for the assessment of independence of all third parties involved in the traceability system (ID issuers, providers of repository services and anti-tampering devices) should be laid down.
(25)The protection of personal data processed in the context of a traceability system should be ensured in accordance with Directive 95/46/EC of the European Parliament and of the Council.
(26)Compliance with certain international standards can be used as proof that certain requirements of this Regulation are fulfilled. Where it is not possible to prove compliance with international standards, it should be the responsibility of the persons to whom the obligations are imposed to prove, by verifiable means, that they comply with those requirements.
(27)The measures provided for in this Regulation are in accordance with the opinion of the Committee referred to in Article 25 of Directive 2014/40/EU,
HAS ADOPTED THIS REGULATION:
CHAPTER I
SUBJECT MATTER AND DEFINITIONS
Article 1
Subject matter
This Regulation lays down the technical standards for the establishment and operation of the traceability system provided for in Article 15 of Directive 2014/40/EU.
Article 2
Definitions
For the purposes of this Regulation, in addition to the definitions laid down in Article 2 of Directive 2014/40/EU, the following definitions shall apply:
(1)‘unique identifier’ means the alphanumeric code enabling the identification of a unit pack or an aggregated packaging of tobacco products;
(2)‘economic operator’ means any natural or legal person who is involved in the trade of tobacco products, from the manufacturer to the last economic operator before the first retail outlet;
(3)‘aggregated packaging’ means any packaging containing more than one unit packet of tobacco products;
(4)‘facility’ means any building where tobacco products are manufactured or stored;
(5)‘anti-tampering device’ means the device allowing for recording of the verification process following the application of each unit level unique identifier by means of a video or a log file, which once recorded cannot be further altered by an economic operator;
(6)‘offline flat-files’ means the electronic files that contain data allowing for the extraction of information encoded in the unique identifiers (excluding the timestamp) used at the unit packet and aggregated packaging levels without accessing the repository system;
(7)‘registry’ means the record of all the identifier codes generated for economic operators, facilities and machines along with the corresponding information;
(8)‘data carrier’ means a carrier representing data in a form readable with the aid of a device;
(9)‘machine’ means machinery which is designed, or adapted, to be used for the manufacture of tobacco products and is integral to the manufacturing process;
(10)‘time stamp’ means the date and time of occurrence of a particular event recorded in UTC (Coordinated Universal Time) time in a prescribed format;
(11)‘primary repository’ means a repository containing data that originate from one manufacturer or importer;
(12)‘secondary repository’ means a repository containing a copy of all data stored in the primary repositories;
(13)‘router’ means a device established within the secondary repository that transfers data between different components of the repository system;
(14)‘repository system’ means the system consisting of the primary repositories, the secondary repository and the router;
(15)‘common data dictionary’ means a set of information describing the contents, format, and structure of a database and the relationship between its elements, used to control access to and manipulation of the databases common for all primary and secondary repositories;
(16)‘working day’ means any day from Monday to Friday except legal holidays in the Member State for which the ID issuer is competent.
CHAPTER II
TECHNICAL SPECIFICATIONS RELATED TO THE UNIQUE IDENTIFIER
Section 1
Common provisions
Article 3
ID issuer
1.Each Member State shall appoint an entity (the ‘ID issuer’) responsible for generating and issuing unique identifiers, in accordance with Articles 8, 9, 11 and 13, within a maximum period of six months from the date of entry into force of this Implementing Regulation.
2.The ID issuer shall be independent and comply with the criteria set out in Article 35.
3.Each ID issuer shall be equipped with a unique identification code. The code shall be composed of maximum three alphanumeric characters and comply with standard ISO/IEC 15459-2:2015.
4.Where the same ID issuer is appointed in more than one Member State, it shall be identifiable by the same code.
5.Member States shall notify the Commission of the appointment of the ID issuer and of its identification code within one month of its appointment.
6.Member States shall ensure that information related to the identity of the ID issuer appointed and its identification code is made publicly available and accessible online.
7.Member States shall put in place adequate measures to ensure:
(a)that the ID issuer continues to comply with the requirement of independence in accordance with Article 35; and
(b)the continuous operation of the services provided by successive ID issuers, in case a new ID issuer is appointed to take over the services from the previous ID issuer.
8.The ID issuer may charge fees to economic operators for generating and issuing unique identifiers. Fees must be non-discriminatory and proportionate to the number of unique identifiers generated and issued to economic operators.
Article 4
Competent ID issuers
1.For tobacco products manufactured in the Union, the competent ID issuer shall be either one of the following:
(a)the entity appointed for the Member State in which the products are manufactured,
(b)the entity appointed for the Member State on whose market the products are placed.
2.For tobacco products aggregated in the Union, the competent ID issuer shall be the entity appointed for the Member State in which the products are aggregated.
3.For tobacco products imported into the Union, the competent ID issuer shall be either one of the following:
(a)the entity appointed for the Member State in which the products were imported,
(b)the entity appointed for the Member State on whose market the products are placed.
Article 5
Validity of unique identifiers and deactivation
1.Unique identifiers may be used to mark unit packets or aggregated packaging, as provided for by Articles 6 and 10, within a maximum period of six months from the date of receipt of the unique identifiers by the economic operator. After this time period unique identifiers shall become invalid and economic operators shall ensure that they are not used to mark unit packets or aggregated packaging.
2.The repositories system shall ensure that the unique identifiers that have not been used within the six months period referred to in paragraph 1 shall be automatically deactivated.
3.At any time, manufacturers and importers may obtain the deactivation of unique identifiers by transmitting a deactivation request to the relevant primary repository. Other economic operators may obtain the deactivation of the unique identifiers by transmitting a deactivation request to the router. The deactivation request shall be introduced electronically, in accordance with Article 36, and shall contain the information listed in point 2.3.of Section 2 of Chapter II of Annex II, in the format indicated therein.
Section 2
Unique identifiers at unit packet level
Article 6
Marking by means of unit level UIs
1.Manufacturers and importers shall mark each unit packet manufactured or imported in the Union with a unit level UI compliant with Article 8.
2.In the case of tobacco products that are manufactured outside the Union, the unit level UI shall be applied on the unit packet before the tobacco product is imported in the Union.
Article 7
Verification of unit level UIs
1.Manufacturers and importers shall ensure that the application of unit level UIs is directly followed by the verification of the readability of those unit level UIs.
2.The device used to verify the readability of unit level UIs shall be protected with an anti-tampering device supplied and installed by an independent third party.
3.Where the verification process fails to confirm the readability of the unit level UI, manufacturers and importers shall re-apply the unit level UI.
4.Manufacturers and importers shall ensure that the information recorded by the anti-tampering device shall be made available up to three months from the recording.
5.Manufacturers and importers shall, within one week of the receipt of a written request from Member States, provide full access to the record of the verification process created by the anti-tampering device.
Article 8
Structure of unique identifier at unit packet level
1.Each unit packet of tobacco products shall be marked with a unique identifier (‘unit level UI’). It shall consist of: a sequence of a maximum of 50 alphanumeric characters that is unique to a given unit packet; and shall be composed of the following data elements (to be placed in the position indicated):
(a)in position 1, the alphanumeric characters that constitute the ID issuer identification code assigned pursuant to Article 3(3);
(b)in position 2, an alphanumeric sequence, whose probability to be guessed shall be negligible and in any case lower than one in ten thousand (‘serial number’);
(c)in position 3, a code (‘product code’) allowing for the determination of the following:
(a)the place of manufacturing;
(b)the manufacturing facility referred to in Article 16;
(c)the machine used to manufacture the tobacco products referred to in Article 18;
(d)the product description;
(e)the intended market of retail sale;
(f)the intended shipment route;
(g)where applicable, the importer into the Union;
(d)in position 4, the time stamp in the form of a numeric sequence of eight characters, in the format YYMMDDhh, indicating the date and time of manufacture.
2.ID issuers shall be responsible for the generation of a code consisting of the elements listed in paragraph 1, points (a), (b), and (c).
3.Manufacturers or importers shall add the time stamp referred to in paragraph 1, point (d), to the code generated by the ID issuer pursuant to paragraph 2.
4.Unit level UIs shall not be reused.
Article 9
Request and issuing of unit level UIs
1.Manufacturers and importers shall send a request to the competent ID issuer for unit level UIs referred to in Article 8. Requests shall be introduced electronically, in accordance with Article 36.
2.Manufacturers and importers introducing such a request shall supply the information listed in point 2.1. of Section 2 of Chapter II of Annex II, in the format indicated therein.
3.Each ID issuer shall specify whether unit level UIs shall be delivered electronically or physically.
4.Where unit level UIs are delivered electronically, the ID issuer shall within two working days from the receipt of the request and in the order indicated:
(a)generate the codes referred to in Article 8(2);
(b)transmit the codes along with the information referred to in paragraph 2 via the router to the primary repository of the requesting manufacturer or importer, as established under Article 26; and
(c)transmit the codes to the requesting manufacturer or importer.
5.Where unit level UIs are delivered physically, the ID issuer shall within 10 working days from the receipt of the request, and in the following order:
(a)generate the codes referred to in Article 8(2);
(b)transmit the codes along with the information referred to in paragraph 2 via the router to the primary repository of the requesting manufacturer or importer, as established under Article 26; and
(c)deliver the codes to the requesting manufacturer or importer in the form of optical barcodes, compliant with Article 21, placed on physical carriers, such as adhesive labels.
6.Within one working day, manufacturers and importers may cancel a request which was sent pursuant to paragraph 1 by means of a recall message as further defined in Point 5 of Section 5 of Chapter II.
Section 3
Unique identifiers at aggregated packaging level
Article 10
Marking by means of aggregated level UIs
For the purpose of discharging their obligation under Article 15(5) of Directive 2014/40/EU by means of the recording of aggregated packaging, economic operators shall mark each aggregated packaging containing tobacco products with an aggregated level UI compliant with Article 11.
Article 11
Structure of unique identifiers at aggregated packaging level
1.Each aggregated packaging containing tobacco products shall be marked with a unique identifier (‘aggregated level UI’). It shall consist of a sequence of a maximum of 100 alphanumeric characters that is unique to a given aggregated package and shall be composed of the following data elements, (to be placed in the position indicated):
(a)in position 1, the alphanumeric characters that constitute the ID issuer identification code assigned under Article 3(3);
(b)in position 2, an alphanumeric sequence, whose probability to be guessed shall be negligible and in any case lower than one in ten thousand (‘serial number’);
(c)in position 3, the identifier code of the facility (as set out in Article 16) in which the aggregation process took place;
(d)in position 4, the time stamp in the form of a numeric sequence of eight characters, in the format YYMMDDhh, indicating the date and time of aggregation.
2.ID issuers shall be responsible for the generation of a code consisting of the elements listed in paragraph 1, point (a), (b), and (c).
3.Economic operators shall add the time stamp, referred to in paragraph 1, point (d), to the code generated by the ID issuer pursuant to paragraph 2.
4.The aggregated level UI may be completed by the economic operator with additional information, such as a SSCC-18 container code generated in line with ISO6346:1995. Any such information may only appear after the data referred to in paragraph 1.
Article 12
Link between UI levels
1.The aggregated level UI shall be capable of identifying the list of all unique identifiers contained within the aggregated packaging by means of an electronically accessible link to the repositories system.
2.In order to establish the link referred to in paragraph 1, economic operators shall transmit to the relevant data storage the information listed in point 3.2 of Section 2 of Chapter II of Annex II, in the format indicated therein.
Article 13
Request and issuing of aggregated level UIs
1.Economic operators shall send a request to the competent ID issuer for the aggregated level UIs referred to in Article 11. Requests shall be introduced electronically, in accordance with Article 36.
2.Economic operators introducing such a request shall supply the information listed in point 2.2. of Section 2 of Chapter II of Annex II, in the format indicated therein.
3.For manufacturers and importers, the ID issuer shall, within two working days from the receipt of the request and in the order indicated:
(a)generate the code referred to in Article 11(2);
(b)transmit the codes along with the information referred to in paragraph 2 via the router to the primary repository of the requesting manufacturer or importer, as established under Article 26; and
(c)transmit the codes electronically to the requesting manufacturer or importer.
4.For economic operators other than manufacturers and importers, the ID issuer shall, within two working days from the receipt of the request and in the order indicated:
(a)generate the code referred to in Article 11(2);
(b)transmit the codes along with the information referred to in paragraph 2 via the router to the secondary repository, as established under Article 26; and
(c)transmit the codes electronically to the requesting economic operators.
5.Within one working day, economic operators may cancel a request which was sent pursuant to paragraph 1 by means of a recall message as further defined in point 5 of Section 5 of Chapter II of Annex II, in the format indicated therein.
6.Aggregated level UIs shall not be reused.
CHAPTER III
Identifier codes for economic operators, facIlities and machines
Article 14
Request for an economic operator identifier code
1.Economic operators and operators of retail outlets shall apply for an economic operator identifier code from the ID issuer competent for each Member State in which they operate at least one facility. Regardless of the operation of facilities, importers shall apply for an identifier code with the competent ID issuer.
2.Economic operators and operators of retail outlets introducing a request pursuant to paragraph 1 shall provide the information listed in point 1.1 of Section 1 of Chapter II of Annex II, in the format indicated therein.
3.For operators of retail outlets the obligation to apply for an economic operator identifier code may also be discharged by any other registered economic operator. Such registration by the third party shall be subject to the consent of the operator of the retail outlet. The third party shall inform the operator of the retail outlet of the full details of the registration, including the allocated economic operator identifier code.
4.Economic operators and operators of retail outlets shall inform the ID issuer of any economic operator identifier codes allocated to them by other ID issuers. If not available at the time of registration, economic operators shall provide that information at the latest within two working days from the receipt of the economic operator identifier codes allocated by another ID issuer.
5.Any modification of the information submitted in the initial application form and any cessation of the operator activities shall be notified by the relevant operator to the competent ID issuer without delay, in the formats indicated in points 1.2. and 1.3. of Section 1 of Chapter II of Annex II.
6.By way of derogation from paragraph 1, transport operators not involved in trans-loading of products shall not be required to apply for an economic operator identifier code.
Article 15
Issuing and registration of economic operator identifier codes
1.Upon receipt of a request pursuant to Article 14, the ID issuer shall generate an economic operator identifier code, which consist of the following data elements, to be placed in the following order:
(a)in position 1, the three alphanumeric characters that constitute the ID issuer identification code assigned under Article 3(3); and
(b)in position 2, an alphanumeric sequence which is unique within the code pool of the ID issuer.
2.Within two working days, the ID issuer shall transmit the code to the requesting operator.
3.All the information submitted to the ID issuer in accordance with Article 14(2), and the corresponding identifier codes, shall form part of a registry to be established, managed and kept up to date by the competent ID issuer.
4.In duly justified cases, Member States may require the ID issuer to withdraw an economic operator identifier code.
5.Economic operators and operators of retail outlets shall exchange the information on their respective economic operator identifier code in order to allow economic operators to record and transmit the transactional information, as provided under Article 33.
Article 16
Request for a facility identifier code
1.All facilities involved in the handling and movement of tobacco products from manufacturing to the first retail outlet shall be identified by a code (‘facility identifier code’) generated by the competent ID issuer.
2.Economic operators and operators of retail outlet shall apply for a facility identifier code providing to the competent ID issuer the information listed in point 1.4. of Section 1 of Chapter II of Annex II, in the format indicated therein.
3.For retail outlets, the obligation to apply for a facility identifier code shall lie with the operator of the retail outlet. This obligation may also be discharged by any other registered economic operator, who may act on behalf of the operator of the retail outlet. The registration by the third party shall be subject to the consent of the operator of the retail outlet. The third party shall inform the operator of the retail outlet about the full details of the registration, including the allocated facility identifier code.
4.The obligation to apply for a facility identifier code related to manufacturing facilities located outside the Union shall lie with the importer established inside the Union. The importer shall apply to the competent ID issuer. The registration by the importer shall be subject to the consent of the entity responsible for the third country manufacturing facility. The importer shall inform the economic operator responsible for the third country manufacturing facility about the full details of registration, including the allocated facility identifier code.
5.Any modification of the information submitted in the initial application form and any facility closure shall be notified by the economic operator to the competent ID issuer without delay, in the formats indicated in points 1.5 and 1.6. of Section 1 of Chapter II of Annex II.
Article 17
Issuing and registration of facility identifier codes
1.Upon receipt of a request pursuant to Article 16, the ID issuer shall generate a facility identifier code, which consists of the following data elements, to be placed in the following order:
(a)In position 1, the alphanumeric characters that constitute the ID issuer identification code assigned under Article 3(3); and
(b)In position 2, an alphanumeric sequence which is unique within the code pool of the ID issuer.
2.Within two working days from the receipt of the request, the ID issuer shall transmit the code to the requesting operator.
3.All the information submitted to the ID issuer in accordance with Article 16(2), and the corresponding identifier codes shall form part of a registry to be established, managed and kept up to date by the competent ID issuer.
4.In duly justified cases, Member States may require the ID issuer to withdraw a facility identifier code.
5.Economic operators and operators of retail outlets shall exchange the information on their respective economic operator identifier code in order to allow economic operators to record and transmit the information on products movements, as provided under Article 32.
Article 18
Request for a machine identifier code
1.Each machine shall be identified by a code (‘machine identifier code’) generated by the ID issuer competent for the territory in which the machine is located.
2.Manufacturers and importers shall apply for a machine identifier code by providing to the competent ID issuer the information listed in point 1.7. of Section 1 of Chapter II of Annex II, in the format indicated therein.
3.The obligation to apply for a machine identifier code related to manufacturing facilities located outside the Union shall lie with the importer established inside the Union. The importer shall apply to the competent ID issuer. The registration by the importer shall be subject to the consent of the entity responsible for the third country manufacturing facility. The importer shall inform the economic operator responsible for the third country manufacturing facility about the full details of registration, including the allocated machine identifier code.
4.Any modification of the information submitted in the initial application form and any decommissioning of the registered machines shall be notified by the manufacturer or the importer to the competent ID issuer without delay, in the formats indicated in points 1.8 and 1.9. of Section 1 of Chapter II of Annex II.
Article 19
Issuing and registration of machine identifier codes
1.Upon receipt of a request pursuant to Article 18, the ID issuer shall generate a facility identifier code, which consists of the following data elements, to be placed in the indicated position:
(a)In position 1, the alphanumeric characters that constitute the ID issuer identification code assigned under Article 3(3); and
(b)In position 2, an alphanumeric sequence which is unique within the code pool of the ID issuer.
2.Within two working days, the ID issuer shall transmit the code to the requesting operator.
3.All the information submitted to the ID issuer in accordance with Article 18(2), and the corresponding identifier codes shall form part of a registry to be established, managed and kept up to date by the relevant ID issuer.
4.In duly justified cases, Member States may require the ID issuer to withdraw a machine identifier code.
Article 20
Registry and offline flat-files
1.ID issuers shall establish offline flat-files.
2.Offline flat-files shall be no larger than two gigabytes per ID issuer.
3.ID issuers shall ensure that a copy of all identifier codes, along with the information referred to in Articles 14(2), 16(2) and 18(2), and offline flat-files are electronically provided via the router to the secondary repository. The copy shall be kept up-to-date by the ID issuers.
4.Member States may adapt the size limit for offline flat-files referred to in paragraph 2, taking into account both the average size of available memory installed on the verification devices used for offline checks of unique identifiers and the total number of ID issuers.
CHAPTER IV
DATA CARRIER
Article 21
Data carriers for the Unique Identifiers
1.Unit level UIs shall be encoded using at least one of the following barcodes:
(a)an optical device-readable Data Matrix with error detection and correction equivalent to or higher than those of the Data Matrix ECC200. Barcodes conforming to the International Organization for Standardisation/International Electrotechnical Commission standard (‘ISO/IEC’) 16022:2006 shall be presumed to fulfil the requirements set out in this point;
(b)an optical device-readable QR Code with a recovery capacity of approximately 30%. Barcodes conforming to ISO/IEC 18004:2015 with the error correction level H shall be presumed to fulfil the requirements set out in this point;
(c)an optical device-readable DotCode with the error detection and correction equivalent to or higher than those provided with the Reed-Solomon error correction algorithm with the number of check characters (NC) equal to three plus the number of data characters (ND) divided by two (NC = 3 + ND / 2). Barcodes conforming to the ISS DotCode Symbology Specification published by the Association for Automatic Identification and Mobility (‘AIM’) (revision 3.0, August 2014) shall be presumed to fulfil the requirements set out in this point.
2.In the case of unit level UIs delivered electronically, manufacturers and importers are responsible for encoding unit level UIs in accordance with paragraph 1.
3.In the case of unit level UIs delivered physically, ID issuers are responsible for encoding the codes generated pursuant to Article 8(2), in accordance with paragraph 1 of this Article.
4.By way of derogation from paragraph 1, manufacturers and importers may encode the time stamp separately from unit level UIs in the format YYMMDDhh.
5.Aggregated level UIs shall be encoded by economic operators using at least one of the following barcodes:
(a)an optical device-readable Data Matrix with error detection and correction equivalent to or higher than those of the Data Matrix ECC200. Barcodes conforming to the International Organization for Standardisation/International Electrotechnical Commission standard (‘ISO/IEC’) 16022:2006 shall be presumed to fulfil the requirements set out in this point;
(b)an optical device-readable QR Code with a recovery capacity of approximately 30%. Barcodes conforming to ISO/IEC 18004:2015 with the error correction level H shall be presumed to fulfil the requirements set out in this point;
(c)an optical device-readable Code 128 with the error detection equivalent to or higher than the one provided with the algorithm based on the even/odd - bar/space character parity and the check character. Barcodes conforming to ISO/IEC 15417:2007 shall be presumed to fulfil the requirements set out in this point.
Article 22
Quality of the optical barcodes
1.Economic operators shall ensure that the optical barcodes are highly readable. A quality of the optical barcodes rated at least 3.5 in accordance with ISO/IEC 15415:2011 for the two-dimensional barcodes, or in accordance with ISO/IEC 15416:2016 for the linear symbols shall be presumed to fulfil the requirements set out in this Article.
2.Economic operators shall ensure that the optical barcodes are capable of remaining readable for at least five years after their creation.
Article 23
Human-readable code
1.Economic operators shall ensure that each data carrier includes a human-readable code that permits electronic access to the information related to the unique identifiers.
2.Where the dimensions of the packaging allow, the human-readable code shall be adjacent to the optical barcode carrying the unique identifier.
CHAPTER V
REPOSITORIES SYSTEM
Article 24
Components of the repositories system
1.A repositories system shall be composed of the following sub-systems:
(a)repositories which are established for the purpose of storing data relating to tobacco products of individual manufacturers and importers ('primary repositories');
(b)a repository which contains a copy of all data stored in the primary repositories system ('secondary repository');
(c)a routing service ('router') set up and managed by the provider of the secondary repository system.
2.The sub-systems referred to in paragraph 1 shall be fully interoperable with one another, irrespective of the service provider used.
Article 25
General characteristics of the repositories system
1.The repositories system shall satisfy the following conditions:
(b)It shall allow for functional integration of the repositories system into the traceability system, as well as uninterrupted electronic data exchange between the repositories system and other relevant components of the traceability system;
(c)It shall allow for electronic identification and authentication of tobacco products, at unit pack and aggregation levels, by users authorised to do so under this Regulation;
(d)It shall allow for automatic deactivation of unique identifiers in accordance with the rules set out in Article 5;
(e)It shall ensure electronic receipt and storing of information recorded and sent to the repositories system by economic operators and ID issuers, in accordance with the requirements of this Regulation;
(f)It shall ensure storage of data for a period of minimum seven years as of the moment the data are uploaded into the repositories system;
(g)It shall allow for automatic status messaging to economic operators, and to Member States and the Commission as requested, such as in the event of success, error or changes related to reporting activities, in accordance with the requirements of this Regulation;
(h)It shall allow for automatic validation of messages received from economic operators, including refusal of incorrect or incomplete messages, in particular reporting activities related to non-registered or duplicated unique identifiers, whereby the repositories system shall store the information concerning any refused message;
(i)It shall ensure messaging between all of its components which shall take place instantaneously, in accordance with the requirements of this Regulation;
(j)It shall ensure continuous availability of all components and services with an annual uptime of at least 99.5% and sufficient back-up mechanisms in place;
(k)It shall be guarded by security procedures and systems ensuring that access to the repositories and download of the data stored therein is only granted to persons authorised according to this Regulation;
(l)It shall be accessible by the competent authorities of Member States and by the Commission. National administrators and Commission services shall be granted access rights enabling them to create, manage, and withdraw user access rights for repositories, and related operations stipulated in this Chapter, via a graphical user management interface. The graphical user management interface shall be compatible with Regulation (EU) No 910/2014, in particular the relevant reusable solutions provided as building blocks under the telecommunication part of the Connecting Europe Facility. National administrators shall be able to grant subsequent access rights to users under their responsibility;
(m)It shall enable Member States and the Commission to carry out downloads of full and selected sets of data stored in a repository;
(n)It shall maintain a complete record ('audit trail') of all operations concerning the stored data, of the users performing those operations and of the nature of these operations, including the history of users access; the audit trail shall be created when the data is uploaded for the first time and, notwithstanding any additional national requirements, be maintained until at least seven years after.
2.Data stored in the repositories system shall be used only for the purposes referred to in Directive 2014/40/EU and this Regulation.
Article 26
Primary repositories
1.Each manufacturer and importer shall ensure the establishment of a primary repository. To that end each manufacturer and importer shall contract an independent third party provider, in accordance with the contractual requirements set out in Commission Delegated Regulation XYZ. The selection of the independent third party shall take place in accordance with the procedural rules laid down in Annex I, Part A.
2.Each primary repository shall exclusively host information which relates to the tobacco products of the manufacturer or importer who contracted the repository.
3.Whenever data are received by the primary repository on the basis of a reporting activity, or for any other permitted reason, it shall be forwarded to the secondary repository instantaneously.
4.In forwarding all data received to the secondary repository, the primary repositories shall use the data format and data exchange modalities defined by the secondary repository.
5.Primary repositories shall store the data in accordance with the common data dictionary provided by the secondary repository.
6.Member States, the Commission, and external auditors approved by the Commission shall be able to carry out basic query requests in relation to all data stored in a primary repository.
Article 27
Secondary repository
1.Providers of the primary repositories shall ensure the establishment of a single secondary repository. To that end they shall appoint among themselves a provider of such a repository. The selection shall be carried out in accordance with the procedure laid down in Annex I, Part B.
2.The secondary repository shall provide for graphical and non-graphical user interfaces that enable Member States and the Commission to access and query the data stored in the repositories system, using all commonly available database search functions, in particular by remotely carrying out the following operations:
(a)retrieval of any information concerning one or multiple unique identifier(s), including the comparison and cross-checking of multiple unique identifiers and the related information, in particular their location;
(b)creation of lists and statistics, such as product stocks and inflow/outflow numbers, associated with one or multiple of the elements of reporting information listed as Data Fields in Annex II;
(c)identification of all tobacco products that have been reported by an economic operator to the system, including the products reported as recalled, withdrawn, stolen, missing or intended for destruction.
3.The user interfaces referred to in paragraph 2 shall enable each Member State and the Commission to define individual rules for:
(a)automatic alerting based on exceptions and specific reporting events, such as abrupt fluctuations or irregularities in trade, attempts to introduce duplicate unique identifiers into the system, and where a product is indicated by economic operators as stolen or missing;
(b)the receipt of periodic reports based on any combination of the elements of reporting information listed as Data Field in Annex II.
4.Automatic alerts and periodic reports referred to in paragraph 3 shall be forwarded to recipient addresses indicated by Member States and the Commission such as individual e-mail addresses and/or Internet Protocol (IP) addresses belonging to external systems used and managed by national authorities or the Commission.
5.The user interfaces referred to in paragraph 2 shall enable Member States and the Commission to connect remotely to the data stored in the repositories system with the analytical software of their choice.
6.The user interfaces referred to in paragraph 2 shall be provided at least in the English language.
7.The overall response time of the repository to any given query or alert trigger, not considering the speed of the internet connection of the end user, shall be no more than 5 seconds for the data stored for less than 2 years and no more than 10 seconds for the data stored for 2 years or more, in at least 99% of all queries and automatic alerts foreseen under paragraphs 2 and 3.
8.The overall time between the arrival of reporting activity data and its accessibility, via the graphical and non-graphical interfaces, in the primary and secondary repositories shall be no more than 60 seconds in at least 99% of all data transfer activities.
9.The repository shall allow for the receipt, storing and making available of offline flat-files for the purpose of updating verification devices used by Member States for offline decoding of unique identifiers.
10.Member States and the Commission shall retain the right to enter into additional service level agreements with the provider of the secondary repository for the purpose of contracting the latter to carry out additional services not provided for by this Regulation.
11.The repository services provided to Member States and the Commission under this Article shall be compatible with Regulation (EU) No 910/2014 and in particular allow for the use of reusable solutions provided as building blocks under the telecommunication part of the Connecting Europe Facility.
Article 28
Coordination tasks of the provider of the secondary repository
1.The provider operating the secondary repository shall communicate to providers operating primary repositories, ID issuers and economic operators, specifications required for the data exchange with the secondary repository and the router. The list shall be communicated no later than two months following the date when the provider operating the secondary repository was selected.
2.On the basis of the information listed in Annex II, the provider operating the secondary repository shall establish a common data dictionary. The common data dictionary shall refer to labels of data fields in the human readable format. The common data dictionary shall be communicated to the providers operating primary repositories no later than two months following the date when the provider operating the secondary repository was selected.
3.Whenever necessary for the smooth operation of the repository system, the provider operating the secondary repository shall update the list referred to in paragraph 11 and the common data dictionary referred to in paragraph 12 and shall communicate the updates to providers operating primary repositories.
Article 29
Router
1.The provider of the secondary repository shall set up and manage a router.
2.Data exchange between the router and the primary and secondary repositories shall take place using the data format and data exchange modalities defined by the router.
3.Data exchange between the router and an ID issuer shall take place using the data format and data exchange modalities defined by the router.
4.Economic operators other than manufacturers and importers shall send the information recorded pursuant to Article 15 of Directive 2014/40/EU and in accordance with this Regulation to the router, which shall transfer it to the primary repository serving the manufacturer or importer whose tobacco products are concerned. A copy of those data shall be transferred instantaneously to the secondary repository system.
Article 30
Costs of the repositories system
1.All costs related to the repositories system set out in Article 24(1) shall be borne by manufacturers and importers of tobacco products. Those costs shall be fair, reasonable, and proportionate:
(a)to the services rendered; and
(b)to the amount of unit level UIs requested over a given period of time.
2.The costs, as applicable, of establishing and operating the secondary repository and the router shall be transmitted to manufacturers and importers of tobacco products through the costs charged to them by the providers of the primary repositories.
Article 31
Deadline for the establishment of the repositories system
The repository system shall be established and functional for testing purposes by 20 March 2019.
CHAPTER VI
RECORDING AND TRANSMITTING
Article 32
Recording and transmission of information on product movements
1.To allow the determination of the actual shipment route of unit packets, economic operators shall record the following events:
(a)application of unit level UIs on unit packets,
(b)application of aggregated level UIs on aggregated packaging,
(c)dispatch of tobacco products from a facility,
(d)arrival of tobacco products at a facility,
(e)trans-loading.
2.Economic operators shall transmit the information listed in Section 3 of Chapter II of Annex II, in the format indicated therein, to the primary repositories, in the case of manufacturers and importers, or to the router, in the case of all other economic operators.
3.For dispatch and trans-loading of small consignments of tobacco products with total net product weight below 5kg destined outside the Union, the recording obligation may be discharged by means of providing an access to the track and trace record generated by the logistic operator approved for this purpose by the Member State of the dispatch facility.
4.If following the application of the unique identifier tobacco products are destroyed or stolen, economic operators shall promptly transmit a deactivation request in accordance with the scope and format specified in point 2.3.of Section 2 of Chapter II of Annex II.
5.The information concerning the event shall be deemed to have been transmitted successfully upon the acknowledgement by the primary repository or the router. The acknowledgement shall include a message recall code to be applied by the economic operator if the original message needs to be annulled.
Article 33
Recording and transmission of transactional information
1.To allow the determination of the transactional information referred to in Article 15(2), points (j) and (k) of Directive 2014/40/EU, economic operators shall record the following events:
(a)issuing of the invoice,
(b)issuing of the order number,
(c)receipt of the payment.
2.Economic operators shall transmit the information listed in Section 4 of Chapter II of Annex II, in the format indicated therein, to the primary repositories, in the case of manufacturers and importers, or to the router, in the case of all other economic operators.
3.The responsibility for recording and transmitting the information referred to in paragraph 2 shall lie with the vendor.
4.The information referred to in paragraph 2 shall be deemed to have been transmitted successfully upon the acknowledgement by the primary repositories or the router. The acknowledgement shall include a message recall code to be applied by the economic operator if the original message needs to be annulled.
Article 34
Time frame for transmission of required information
1.Economic operators shall transmit the information referred to in Article 32(1) points (a), (b) and (d) and Article 33(1), within 3 hours from the occurrence of the event.
2.For the purposes of paragraph 1, the events referred to in Article 32 shall be deemed to occur at the first moment when they can be associated with the relevant set of unique identifiers.
3.Economic operators shall transmit the information concerning the dispatch of tobacco products from a facility and trans-loading referred to in Article 32(1) points (c) and (e), within the 24 hours prior to the occurrence of the event.
4.By way of derogation from paragraph 1, economic operators falling under the definition of small and medium enterprises set out in Commission Recommendation 2003/361/EC may transmit the information referred to in Article 32(1) points (a), (b) and (d) and Article 33(1), within 24 hours from the occurrence of the event.
5.Paragraph 1 shall apply from 20 May 2026. Until that date all economic operators may transmit the information referred to in paragraph 1 within 24 hours from the occurrence of the event.
CHAPTER VIII
FINAL PROVISIONS
Article 35
Independence
1.Member States shall ensure that ID issuers, providers of repository services and anti-tampering devices are independent and exercise their functions impartially.
2.The following criteria shall be used to assess independence:
(d)independence from the tobacco industry in terms of legal form, organisation and decision making. In particular it shall be assessed whether the entity is not under the direct or indirect control of the tobacco industry, including a minority shareholding;
(e)independence from the tobacco industry in financial terms, which will be presumed if the entity generates less than 20% of its annual overall turnover with the goods and services supplied to the tobacco sector;
(f)absence of conflicts of interests with the tobacco industry of the persons responsible for the management of the entity. In particular, they:
(1)shall not participate in company structures of the tobacco industry;
(2)shall act independently from any interest linked to the tobacco industry.
3.Any change in circumstances related to the above criteria that would influence the assessment of the entity's independence, shall be communicated without delay by the primary repository provider to the Commission.
Article 36
Security and integrity of communications and data
1.All electronic communication provided for under this Regulation shall be carried out using secure means. Applicable security protocols and connectivity rules shall be established by:
(g)the ID issuer for communications between the ID issuer and the economic operators registering with the ID issuer or requesting unique identifiers;
(h)the providers of the primary repositories for communications between the primary repositories and manufactures or importers;
(i)the provider of the secondary repository for communications between the secondary repository and the router and:
(a)the ID issuers;
(b)the primary repositories; and
(c)economic operators using the router, i.e. economic operators other than manufacturers and importers.
2.Providers of primary and secondary repositories shall be responsible for the security and integrity of hosted data.
3.For all transfers of data, the sending party is responsible for the completeness of transferred data. In order for the sending party to discharge this obligation, the receiving party shall acknowledge the receipt of transferred data including a checksum value of actual transmitted data or any alternative mechanism allowing for validating the integrity of transmission, in particular its completeness.
Article 37
Transitional provision
1.Cigarettes and roll-your-own tobacco products that were manufactured in the Union or imported into the Union before 20 May 2019 and not marked by means of unit level UIs in accordance with Article 8 may remain in free circulation until 20 May 2020. In relation to these tobacco products which are allowed to remain in free circulation, but not marked with a unit level UIs, the obligations referred to in Chapter VI shall not apply.
2.Tobacco products other than cigarettes and roll-your-own products that were manufactured in the Union or imported into the Union before 20 May 2024 and not marked by means of unit level UIs in accordance with Article 8 may remain in free circulation until 20 May 2025. In relation to these tobacco products which are allowed to remain in free circulation, but not marked with a unit level UIs, the obligations referred to in Chapter VI shall not apply.
Article 38
Entry into force
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels,
For the Commission
The President
