14.8.2013   

EN

Official Journal of the European Union

L 218/1

(1)

On 23 February 2006, the International Labour Organisation (ILO) adopted the Maritime Labour Convention, 2006 (MLC 2006), desiring to create a single, coherent instrument embodying as far as possible all up-to-date standards of existing international maritime labour Conventions and Recommendations, as well as the fundamental principles to be found in other international labour conventions.

(2)

Council Decision 2007/431/EC (3) authorised Member States, in the interests of the European Community, to ratify MLC 2006. Therefore, Member States should ratify it as soon as possible.

(3)

Member States, when performing port State control inspections in accordance with Directive 2009/16/EC of the European Parliament and of the Council of 23 April 2009 on port State control (4) in relation to matters covered by Conventions which they have not yet ratified and which stipulate that every ship is subject to control by officers duly authorised when in a port of another contracting State or Party, should make every effort to comply with procedures and practices under those Conventions and should thus refrain from making reports relevant to port State control to the International Maritime Organisation (IMO) and/or the ILO. Member States which have not yet ratified an international convention covered by Directive 2009/16/EC at the time of its entry into force should make every effort to establish similar conditions on board their ships in accordance with the requirements of that Convention.

(4)

In order to ensure a harmonised approach to the effective enforcement of international standards by Member States when performing both flag and port State control inspections and to avoid friction between international and Union law, Member States should aim at ratifying the Conventions by the date on which they enter into force, at least those parts thereof falling under Union competence.

(5)

MLC 2006 sets out maritime labour standards for all seafarers regardless of their nationality and of the flag of the ships on which they serve.

(6)

For the purposes of Directive 2009/16/EC, it is preferable, rather than the terms ‘seafarer’ and ‘crew’ being defined, that those terms be understood in each instance in accordance with the way in which they are defined or understood in the relevant international conventions. In particular, for any matters relating to the enforcement of MLC 2006, the term ‘crew’ should be understood as referring to ‘seafarer’ as defined in MLC 2006.

(7)

For any matters covered by this Directive relating to the enforcement of MLC 2006, including for ships for which the International Safety Management Code is not applicable, references in Directive 2009/16/EC to ‘company’ should be understood to mean ‘shipowner’ as defined by the relevant provision of MLC 2006, since the latter definition better fits the specific needs of MLC 2006.

(8)

A substantial part of the MLC 2006 standards is implemented within Union law by means of Council Directive 2009/13/EC of 16 February 2009 implementing the Agreement concluded by the European Community Shipowners’ Associations (ECSA) and the European Transport Workers’ Federation (ETF) on the Maritime Labour Convention, 2006 (5) and Council Directive 1999/63/EC of 21 June 1999 concerning the Agreement on the organisation of working time of seafarers concluded by the European Community Shipowners’ Association (ECSA) and the Federation of Transport Workers’ Unions in the European Union (FST) (6). Those MLC 2006 standards which fall within the scope of Directive 2009/13/EC or Directive 1999/63/EC are to be implemented by the Member States in line with those Directives.

(9)

As a matter of general principle, the measures adopted to give effect to this Directive should under no circumstances constitute grounds justifying a reduction by Member States in the general level of protection of seafarers on board ships flying the flag of a Member State under the applicable Union social law.

(10)

MLC 2006 contains enforcement provisions defining the responsibilities of States performing port State control obligations. In order to protect safety and to avoid distortions of competition, Member States should be allowed to verify compliance with the provisions of MLC 2006 by any ship calling at their ports and anchorages, irrespective of the State whose flag it flies.

(11)

Port State control is governed by Directive 2009/16/EC, which should include MLC 2006 among the Conventions the implementation of which is verified by Member States’ authorities in their ports.

(12)

Member States, when performing port State control inspections in accordance with Directive 2009/16/EC, should take into account the provisions of MLC 2006 which stipulate that the maritime labour certificate and the declaration of maritime labour compliance are to be accepted as prima facie evidence of compliance with the requirements of MLC 2006.

(13)

The law of the Union should also reflect the procedures set out in MLC 2006 with regard to the handling of onshore complaints relating to the matters dealt with in MLC 2006.

(14)

In order to ensure uniform conditions for the implementation of Directive 2009/16/EC, implementing powers should be conferred on the Commission. The Commission should be entitled to adopt implementing acts: to implement a methodology for the consideration of generic risk parameters relating in particular to the flag State criteria and company performance criteria; to ensure uniform conditions for the scope of expanded inspections, including the risk areas to be covered; to ensure uniform application of the procedures for the control and security checks of ships; to set up a harmonised electronic format for the reporting of complaints related to MLC 2006; to implement harmonised procedures for the reporting of apparent anomalies by pilots and port authorities or bodies and of follow-up actions taken by Member States; and to establish the detailed arrangements for publication of information on companies with a low and very low performance, the criteria for aggregating the relevant data and the frequency of updates. This is a highly technical exercise to be carried out in the framework of the principles and criteria which have been established by that Directive. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers (7).

(15)

Implementing acts relating to the methodology for the consideration of generic risk parameters concerning in particular the flag State criteria and company performance criteria, to the reports from pilots and port authorities or bodies, including harmonised procedures for the reporting of apparent anomalies by pilots and port authorities or bodies and of follow-up actions taken by Member States, and to the detailed arrangements for the publication of information on companies with a low or very low performance, should not be adopted by the Commission where the committee referred to in this Directive delivers no opinion on the draft implementing act presented by the Commission.

(16)

When establishing implementing rules, the Commission should specifically take into account the expertise and experience gained with the inspection system in the Union and build upon the expertise of the Memorandum of Understanding on Port State Control, signed in Paris on 26 January 1982, in its up-to-date version (‘Paris MOU’).

(17)

The implementing rules, including references to Paris MOU instructions and guidelines, should not compromise the exercise of the professional judgment of inspectors or of the competent authority and the flexibility provided for in Directive 2009/16/EC.

(18)

The inspection database referred to in Directive 2009/16/EC should be adapted and developed in line with the amendments introduced by this Directive or changes adopted within the context of the Paris MOU.

(19)

The Paris MOU seeks to eliminate the operation of sub-standard ships through a harmonised system of port State control, comprising coordinated inspection of ships calling at ports, including Member States’ ports, in the Paris MOU Region. Those inspections are aimed at verifying that ships meet international safety, security and environmental standards, and that seafarers have adequate living and working conditions, in conformity with the international conventions in force. When inspections are carried out and when reference is made to Paris MOU instructions and guidelines, account should be taken of the fact that those instructions and guidelines are developed and adopted to ensure consistency and to guide inspections with a view to facilitating the greatest possible degree of convergence.

(20)

The inspection of on-board living and working conditions of seafarers and of their training and qualifications, to verify that these comply with the requirements of MLC 2006, requires the necessary level of training for inspectors. The European Maritime Safety Agency and Member States should promote the issue of training for inspectors for the purposes of reviewing compliance with MLC 2006.

(21)

In order to allow the Commission to update the relevant procedures swiftly, thereby contributing to the achievement of a global level playing field for shipping, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of amendments to Annex VI to Directive 2009/16/EC containing the list of the ‘Instructions’ adopted by the Paris MOU, with a view to keeping the procedures applicable and enforceable in the territory of the Member States, in line with those agreed upon at international level and in compliance with the relevant Conventions. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level. The Commission, when preparing and drawing-up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

(22)

Since the objectives of this Directive cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale or effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve those objectives.

(23)

Directive 2009/16/EC should therefore be amended accordingly.

(24)

According to Article VIII, MLC 2006 is to come into force 12 months after the date on which there have been registered ratifications by at least 30 Members of the ILO with a total share in the world gross tonnage of ships of 33 per cent. This condition was fulfilled on 20 August 2012, and MLC 2006 enters into force on 20 August 2013.

(25)

This Directive should enter into force on the same date as MLC 2006,

(1)

Article 2 is amended as follows:

(2)

Article 3 is amended as follows:

(3)

In Article 8, paragraph 4 is deleted.

(4)

In Article 10, paragraph 3 is replaced by the following:

‘3.   Implementing powers shall be conferred on the Commission to implement a methodology for the consideration of generic risk parameters relating in particular to the flag State criteria and company performance criteria. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 31(3).’.

(5)

In Article 14, paragraph 4 is replaced by the following:

‘4.   The scope of an expanded inspection, including the risk areas to be covered, is set out in Annex VII. The Commission may adopt detailed measures to ensure uniform conditions for the application of Annex VII. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 31(3).’.

(6)

In Article 15, paragraph 4 is replaced by the following:

‘4.   The Commission may adopt detailed measures to ensure uniform application of the procedures referred to in paragraph 1 and of the security checks referred to in paragraph 2 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 31(3).’.

(7)

In Article 17, the following paragraphs are added:

‘Where, following a more detailed inspection, the living and working conditions on the ship are found not to conform to the requirements of MLC 2006, the inspector shall forthwith bring the deficiencies to the attention of the master of the ship, with required deadlines for their rectification.

In the event that the inspector considers such deficiencies to be significant, or if they relate to a possible complaint under point 19 of Part A of Annex V, the inspector shall also bring the deficiencies to the attention of the appropriate seafarers’ and shipowners’ organisations in the Member State in which the inspection is carried out, and may:

In respect of matters concerning MLC 2006, the Member State in which the inspection is carried out shall have the right to transmit a copy of the inspector’s report, to be accompanied by any reply received from the competent authorities of the flag State within the prescribed deadline, to the Director-General of the International Labour Office with a view to such action as may be considered appropriate and expedient in order to ensure that a record is kept of such information and that it is brought to the attention of parties who might be interested in availing themselves of relevant recourse procedures.’.

(8)

In Article 18, the fourth paragraph is replaced by the following:

‘The identity of the complainant shall not be revealed to the master or the shipowner of the ship concerned. The inspector shall take appropriate steps to safeguard the confidentiality of complaints made by seafarers, including ensuring confidentiality during any interviews of seafarers.’.

(9)

The following Article is inserted:

‘Article 18a

Onshore MLC 2006 complaint-handling procedures

1.   A complaint by a seafarer alleging a breach of the requirements of MLC 2006 (including seafarers’ rights) may be reported to an inspector in the port at which the seafarer’s ship has called. In such cases, the inspector shall undertake an initial investigation.

2.   Where appropriate, given the nature of the complaint, the initial investigation shall include consideration of whether the on-board complaint procedures provided for under Regulation 5.1.5 of MLC 2006 have been pursued. The inspector may also conduct a more detailed inspection in accordance with Article 13 of this Directive.

3.   The inspector shall, where appropriate, seek to promote a resolution of the complaint at the ship-board level.

4.   In the event that the investigation or the inspection reveals a non-conformity that falls within the scope of Article 19, that Article shall apply.

5.   Where paragraph 4 does not apply and a complaint by a seafarer related to matters covered by MLC 2006 has not been resolved at the ship-board level, the inspector shall forthwith notify the flag State, seeking, within a prescribed deadline, advice and a corrective plan of action to be submitted by the flag State. A report of any inspection carried out shall be transmitted by electronic means to the inspection database referred to in Article 24.

6.   Where the complaint has not been resolved following action taken in accordance with paragraph 5, the port State shall transmit a copy of the inspector’s report to the Director-General of the International Labour Office. The report shall be accompanied by any reply received within the prescribed deadline from the competent authority of the flag State. The appropriate seafarers’ and shipowners’ organisations in the port State shall be similarly informed. In addition, statistics and information regarding complaints that have been resolved shall be regularly submitted by the port State to the Director-General of the International Labour Office.

Such submissions are provided in order that, on the basis of such action as may be considered appropriate and expedient, a record is kept of such information and brought to the attention of parties, including seafarers’ and shipowners’ organisations, which might be interested in availing themselves of relevant recourse procedures.

7.   In order to ensure uniform conditions for the implementation of this Article, implementing powers shall be conferred on the Commission regarding the setting-up of a harmonised electronic format and procedure for the reporting of follow-up actions taken by Member States. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 31(3).

8.   This Article shall be without prejudice to Article 18. The fourth paragraph of Article 18 shall also apply to complaints relating to matters covered by MLC 2006.’.

(10)

Article 19 is amended as follows:

(11)

In Article 23, paragraph 5 is replaced by the following:

‘5.   Implementing powers shall be conferred on the Commission to adopt measures for the implementation of this Article, including harmonised procedures for the reporting of apparent anomalies by pilots and port authorities or bodies and of follow-up actions taken by Member States. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 31(3).’.

(12)

In Article 27, the second paragraph is replaced by the following:

‘Implementing powers shall be conferred on the Commission to establish the detailed arrangements for publication of the information referred to in the first paragraph, the criteria for aggregating the relevant data and the frequency of updates. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 31(3).’.

(13)

The following Articles are inserted:

‘Article 30a

Delegated acts

The Commission shall be empowered to adopt delegated acts in accordance with Article 30b, concerning amendments to Annex VI, in order to add to the list set out in that Annex further instructions relating to port State control adopted by the Paris MOU Organisation.

Article 30b

Exercise of the delegation

1.   The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2.   The power to adopt delegated acts referred to in Article 30a shall be conferred on the Commission for a period of five years from 20 August 2013. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.

3.   The delegation of power referred to in Article 30a may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4.   As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5.   A delegated act adopted pursuant to Article 30a shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.’.

(14)

Article 31 is replaced by the following:

‘Article 31

Committee

1.   The Commission shall be assisted by the Committee on Safe Seas and the Prevention of Pollution from Ships (COSS) established by Article 3 of Regulation (EC) No 2099/2002 of the European Parliament and the Council (8). That Committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2.   Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

Where the committee delivers no opinion on a draft implementing act to be adopted pursuant to Articles 10(3), 23(5) and the second paragraph of Article 27 respectively, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.

(15)

Article 32 is deleted.

(16)

Article 33 is replaced by the following:

‘Article 33

Implementing rules

When establishing the implementing rules referred to in Articles 10(3), 14(4), 15(4), 18a(7), 23(5) and 27 in accordance with the procedures referred to in Article 31(3), the Commission shall take specific care that those rules take into account the expertise and experience gained with the inspection system in the Union and build upon the expertise of the Paris MOU.’.

(17)

In Annex I, Part II, point 2B is amended as follows:

(18)

Annex IV is amended as follows:

(19)

In Annex V, Part A, the following points are added:

(20)

In Annex X, point 3.10 is amended as follows:

14.8.2013   

EN

Official Journal of the European Union

L 218/8

(1)

The objectives of this Directive are to approximate the criminal law of the Member States in the area of attacks against information systems by establishing minimum rules concerning the definition of criminal offences and the relevant sanctions and to improve cooperation between competent authorities, including the police and other specialised law enforcement services of the Member States, as well as the competent specialised Union agencies and bodies, such as Eurojust, Europol and its European Cyber Crime Centre, and the European Network and Information Security Agency (ENISA).

(2)

Information systems are a key element of political, social and economic interaction in the Union. Society is highly and increasingly dependent on such systems. The smooth operation and security of those systems in the Union is vital for the development of the internal market and of a competitive and innovative economy. Ensuring an appropriate level of protection of information systems should form part of an effective comprehensive framework of prevention measures accompanying criminal law responses to cybercrime.

(3)

Attacks against information systems, and, in particular, attacks linked to organised crime, are a growing menace in the Union and globally, and there is increasing concern about the potential for terrorist or politically motivated attacks against information systems which form part of the critical infrastructure of Member States and of the Union. This constitutes a threat to the achievement of a safer information society and of an area of freedom, security, and justice, and therefore requires a response at Union level and improved cooperation and coordination at international level.

(4)

There are a number of critical infrastructures in the Union, the disruption or destruction of which would have a significant cross-border impact. It has become apparent from the need to increase the critical infrastructure protection capability in the Union that the measures against cyber attacks should be complemented by stringent criminal penalties reflecting the gravity of such attacks. Critical infrastructure could be understood to be an asset, system or part thereof located in Member States, which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, such as power plants, transport networks or government networks, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions.

(5)

There is evidence of a tendency towards increasingly dangerous and recurrent large-scale attacks conducted against information systems which can often be critical to Member States or to particular functions in the public or private sector. This tendency is accompanied by the development of increasingly sophisticated methods, such as the creation and use of so-called ‘botnets’, which involves several stages of a criminal act, where each stage alone could pose a serious risk to public interests. This Directive aims, inter alia, to introduce criminal penalties for the creation of botnets, namely, the act of establishing remote control over a significant number of computers by infecting them with malicious software through targeted cyber attacks. Once created, the infected network of computers that constitute the botnet can be activated without the computer users’ knowledge in order to launch a large-scale cyber attack, which usually has the capacity to cause serious damage, as referred to in this Directive. Member States may determine what constitutes serious damage according to their national law and practice, such as disrupting system services of significant public importance, or causing major financial cost or loss of personal data or sensitive information.

(6)

Large-scale cyber attacks can cause substantial economic damage both through the interruption of information systems and communication and through the loss or alteration of commercially important confidential information or other data. Particular attention should be paid to raising the awareness of innovative small and medium-sized enterprises to threats relating to such attacks and their vulnerability to such attacks, due to their increased dependence on the proper functioning and availability of information systems and often limited resources for information security.

(7)

Common definitions in this area are important in order to ensure a consistent approach in the Member States to the application of this Directive.

(8)

There is a need to achieve a common approach to the constituent elements of criminal offences by introducing common offences of illegal access to an information system, illegal system interference, illegal data interference, and illegal interception.

(9)

Interception includes, but is not necessarily limited to, the listening to, monitoring or surveillance of the content of communications and the procuring of the content of data either directly, through access and use of the information systems, or indirectly through the use of electronic eavesdropping or tapping devices by technical means.

(10)

Member States should provide for penalties in respect of attacks against information systems. Those penalties should be effective, proportionate and dissuasive and should include imprisonment and/or fines.

(11)

This Directive provides for criminal penalties at least for cases which are not minor. Member States may determine what constitutes a minor case according to their national law and practice. A case may be considered minor, for example, where the damage caused by the offence and/or the risk to public or private interests, such as to the integrity of a computer system or to computer data, or to the integrity, rights or other interests of a person, is insignificant or is of such a nature that the imposition of a criminal penalty within the legal threshold or the imposition of criminal liability is not necessary.

(12)

The identification and reporting of threats and risks posed by cyber attacks and the related vulnerability of information systems is a pertinent element of effective prevention of, and response to, cyber attacks and to improving the security of information systems. Providing incentives to report security gaps could add to that effect. Member States should endeavour to provide possibilities for the legal detection and reporting of security gaps.

(13)

It is appropriate to provide for more severe penalties where an attack against an information system is committed by a criminal organisation, as defined in Council Framework Decision 2008/841/JHA of 24 October 2008 on the fight against organised crime (3), where a cyber attack is conducted on a large scale, thus affecting a significant number of information systems, including where it is intended to create a botnet, or where a cyber attack causes serious damage, including where it is carried out through a botnet. It is also appropriate to provide for more severe penalties where an attack is conducted against a critical infrastructure of the Member States or of the Union.

(14)

Setting up effective measures against identity theft and other identity-related offences constitutes another important element of an integrated approach against cybercrime. Any need for Union action against this type of criminal behaviour could also be considered in the context of evaluating the need for a comprehensive horizontal Union instrument.

(15)

The Council Conclusions of 27 to 28 November 2008 indicated that a new strategy should be developed with the Member States and the Commission, taking into account the content of the 2001 Council of Europe Convention on Cybercrime. That Convention is the legal framework of reference for combating cybercrime, including attacks against information systems. This Directive builds on that Convention. Completing the process of ratification of that Convention by all Member States as soon as possible should be considered to be a priority.

(16)

Given the different ways in which attacks can be conducted, and given the rapid developments in hardware and software, this Directive refers to tools that can be used in order to commit the offences laid down in this Directive. Such tools could include malicious software, including those able to create botnets, used to commit cyber attacks. Even where such a tool is suitable or particularly suitable for carrying out one of the offences laid down in this Directive, it is possible that it was produced for a legitimate purpose Motivated by the need to avoid criminalisation where such tools are produced and put on the market for legitimate purposes, such as to test the reliability of information technology products or the security of information systems, apart from the general intent requirement, a direct intent requirement that those tools be used to commit one or more of the offences laid down in this Directive must be also fulfilled.

(17)

This Directive does not impose criminal liability where the objective criteria of the offences laid down in this Directive are met but the acts are committed without criminal intent, for instance where a person does not know that access was unauthorised or in the case of mandated testing or protection of information systems, such as where a person is assigned by a company or vendor to test the strength of its security system. In the context of this Directive, contractual obligations or agreements to restrict access to information systems by way of a user policy or terms of service, as well as labour disputes as regards the access to and use of information systems of an employer for private purposes, should not incur criminal liability where the access under such circumstances would be deemed unauthorised and thus would constitute the sole basis for criminal proceedings. This Directive is without prejudice to the right of access to information as laid down in national and Union law, while at the same time it may not serve as a justification for unlawful or arbitrary access to information.

(18)

Cyber attacks could be facilitated by various circumstances, such as where the offender has access to security systems inherent in the affected information systems within the scope of his or her employment. In the context of national law, such circumstances should be taken into account in the course of criminal proceedings as appropriate.

(19)

Member States should provide for aggravating circumstances in their national law in accordance with the applicable rules established by their legal systems on aggravating circumstances. They should ensure that those aggravating circumstances are available for judges to consider when sentencing offenders. It remains within the discretion of the judge to assess those circumstances together with the other facts of the particular case.

(20)

This Directive does not govern conditions for exercising jurisdiction over any of the offences referred to herein, such as a report by the victim in the place where the offence was committed, a denunciation from the State of the place where the offence was committed, or the non-prosecution of the offender in the place where the offence was committed.

(21)

In the context of this Directive, States and public bodies remain fully bound to guarantee respect for human rights and fundamental freedoms, in accordance with existing international obligations.

(22)

This Directive strengthens the importance of networks, such as the G8 or the Council of Europe’s network of points of contact available on a 24 hour, seven-day-a-week basis. Those points of contact should be able to deliver effective assistance thus, for example, facilitating the exchange of relevant information available and the provision of technical advice or legal information for the purpose of investigations or proceedings concerning criminal offences relating to information systems and associated data involving the requesting Member State. In order to ensure the smooth operation of the networks, each contact point should have the capacity to communicate with the point of contact of another Member State on an expedited basis with the support, inter alia, of trained and equipped personnel. Given the speed with which large-scale cyber attacks can be carried out, Member States should be able to respond promptly to urgent requests from this network of contact points. In such cases, it may be expedient that the request for information be accompanied by telephone contact in order to ensure that the request is processed swiftly by the requested Member State and that feedback is provided within eight hours.

(23)

Cooperation between public authorities on the one hand, and the private sector and civil society on the other, is of great importance in preventing and combating attacks against information systems. It is necessary to foster and improve cooperation between service providers, producers, law enforcement bodies and judicial authorities, while fully respecting the rule of law. Such cooperation could include support by service providers in helping to preserve potential evidence, in providing elements helping to identify offenders and, as a last resort, in shutting down, completely or partially, in accordance with national law and practice, information systems or functions that have been compromised or used for illegal purposes. Member States should also consider setting up cooperation and partnership networks with service providers and producers for the exchange of information in relation to the offences within the scope of this Directive.

(24)

There is a need to collect comparable data on the offences laid down in this Directive. Relevant data should be made available to the competent specialised Union agencies and bodies, such as Europol and ENISA, in line with their tasks and information needs, in order to gain a more complete picture of the problem of cybercrime and network and information security at Union level and thereby to contribute to formulating a more effective response. Member States should submit information on the modus operandi of the offenders to Europol and its European Cybercrime Centre for the purpose of conducting threat assessments and strategic analyses of cybercrime in accordance with Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol) (4). Providing information can facilitate a better understanding of present and future threats and thus contribute to more appropriate and targeted decision-making on combating and preventing attacks against information systems.

(25)

The Commission should submit a report on the application of this Directive and make necessary legislative proposals which could lead to broadening its scope, taking into account developments in the field of cybercrime. Such developments could include technological developments, for example those enabling more effective enforcement in the area of attacks against information systems or facilitating prevention or minimising the impact of such attacks. For that purpose, the Commission should take into account the available analyses and reports produced by relevant actors and, in particular, Europol and ENISA.

(26)

In order to fight cybercrime effectively, it is necessary to increase the resilience of information systems by taking appropriate measures to protect them more effectively against cyber attacks. Member States should take the necessary measures to protect their critical infrastructure from cyber attacks, as part of which they should consider the protection of their information systems and associated data. Ensuring an adequate level of protection and security of information systems by legal persons, for example in connection with the provision of publicly available electronic communications services in accordance with existing Union legislation on privacy and electronic communication and data protection, forms an essential part of a comprehensive approach to effectively counteracting cybercrime. Appropriate levels of protection should be provided against reasonably identifiable threats and vulnerabilities in accordance with the state of the art for specific sectors and the specific data processing situations. The cost and burden of such protection should be proportionate to the likely damage a cyber attack would cause to those affected. Member States are encouraged to provide for relevant measures incurring liabilities in the context of their national law in cases where a legal person has clearly not provided an appropriate level of protection against cyber attacks.

(27)

Significant gaps and differences in Member States’ laws and criminal procedures in the area of attacks against information systems may hamper the fight against organised crime and terrorism, and may complicate effective police and judicial cooperation in this area. The transnational and borderless nature of modern information systems means that attacks against such systems have a cross-border dimension, thus underlining the urgent need for further action to approximate criminal law in this area. In addition, the coordination of prosecution of cases of attacks against information systems should be facilitated by the adequate implementation and application of Council Framework Decision 2009/948/JHA of 30 November 2009 on prevention and settlement of conflict of jurisdiction in criminal proceedings (5). Member States, in cooperation with the Union, should also seek to improve international cooperation relating to the security of information systems, computer networks and computer data. Proper consideration of the security of data transfer and storage should be given in any international agreement involving data exchange.

(28)

Improved cooperation between the competent law enforcement bodies and judicial authorities across the Union is essential in an effective fight against cybercrime. In this context, stepping up the efforts to provide adequate training to the relevant authorities in order to raise the understanding of cybercrime and its impact, and to foster cooperation and the exchange of best practices, for example via the competent specialised Union agencies and bodies, should be encouraged. Such training should, inter alia, aim at raising awareness about the different national legal systems, the possible legal and technical challenges of criminal investigations, and the distribution of competences between the relevant national authorities.

(29)

This Directive respects human rights and fundamental freedoms and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union and the European Convention for the Protection of Human Rights and Fundamental Freedoms, including the protection of personal data, the right to privacy, freedom of expression and information, the right to a fair trial, the presumption of innocence and the rights of the defence, as well as the principles of legality and proportionality of criminal offences and penalties. In particular, this Directive seeks to ensure full respect for those rights and principles and must be implemented accordingly.

(30)

The protection of personal data is a fundamental right in accordance with Article 16(1) TFEU and Article 8 of the Charter on Fundamental Rights of the European Union. Therefore, any processing of personal data in the context of the implementation of this Directive should fully comply with the relevant Union law on data protection.

(31)

In accordance with Article 3 of the Protocol on the position of the United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, those Member States have notified their wish to take part in the adoption and application of this Directive.

(32)

In accordance with Articles 1 and 2 of the Protocol on the position of Denmark annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Directive and is not bound by it or subject to its application.

(33)

Since the objectives of this Directive, namely to subject attacks against information systems in all Member States to effective, proportionate and dissuasive criminal penalties and to improve and encourage cooperation between judicial and other competent authorities, cannot be sufficiently achieved by the Member States, and can therefore, by reason of their scale or effects, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve those objectives.

(34)

This Directive aims to amend and expand the provisions of Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information systems (6). Since the amendments to be made are of substantial number and nature, Framework Decision 2005/222/JHA should, in the interests of clarity, be replaced in its entirety in relation to Member States participating in the adoption of this Directive,

(a)

‘information system’ means a device or group of inter-connected or related devices, one or more of which, pursuant to a programme, automatically processes computer data, as well as computer data stored, processed, retrieved or transmitted by that device or group of devices for the purposes of its or their operation, use, protection and maintenance;

(b)

‘computer data’ means a representation of facts, information or concepts in a form suitable for processing in an information system, including a programme suitable for causing an information system to perform a function;

(c)

‘legal person’ means an entity having the status of legal person under the applicable law, but does not include States or public bodies acting in the exercise of State authority, or public international organisations;

(d)

‘without right’ means conduct referred to in this Directive, including access, interference, or interception, which is not authorised by the owner or by another right holder of the system or of part of it, or not permitted under national law.

(a)

a computer programme, designed or adapted primarily for the purpose of committing any of the offences referred to in Articles 3 to 6;

(b)

a computer password, access code, or similar data by which the whole or any part of an information system is capable of being accessed.

(a)

they are committed within the framework of a criminal organisation, as defined in Framework Decision 2008/841/JHA, irrespective of the penalty provided for therein;

(b)

they cause serious damage; or

(c)

they are committed against a critical infrastructure information system.

(a)

a power of representation of the legal person;

(b)

an authority to take decisions on behalf of the legal person;

(c)

an authority to exercise control within the legal person.

(a)

exclusion from entitlement to public benefits or aid;

(b)

temporary or permanent disqualification from the practice of commercial activities;

(c)

placing under judicial supervision;

(d)

judicial winding-up;

(e)

temporary or permanent closure of establishments which have been used for committing the offence.

(a)

in whole or in part within their territory; or

(b)

by one of their nationals, at least in cases where the act is an offence where it was committed.

(a)

the offender commits the offence when physically present on its territory, whether or not the offence is against an information system on its territory; or

(b)

the offence is against an information system on its territory, whether or not the offender commits the offence when physically present on its territory.

(a)

the offender has his or her habitual residence in its territory; or

(b)

the offence is committed for the benefit of a legal person established in its territory.

14.8.2013   

EN

Official Journal of the European Union

L 218/15

(1)

Relations between Georgia and the European Union are developing within the framework of the European Neighbourhood Policy. In 2006, the Community and Georgia agreed on a European Neighbourhood Policy Action Plan identifying medium-term priorities in EU-Georgia relations. In 2010, the Union and Georgia launched the negotiations of an Association Agreement that is expected to replace the existing EU-Georgia Partnership and Cooperation Agreement (2). The framework of EU-Georgia relations is further enhanced by the newly launched Eastern Partnership.

(2)

The extraordinary European Council meeting on 1 September 2008 confirmed the Union’s willingness to strengthen EU-Georgia relations in the aftermath of the armed conflict in August 2008 between Georgia and the Russian Federation.

(3)

The Georgian economy has been affected by the international financial crisis since the third quarter of 2008, with declining output, falling fiscal revenues and rising external financing needs.

(4)

At the International Donors’ Conference held on 22 October 2008, the international community pledged support to Georgia’s economic recovery in line with the Joint Needs Assessment carried out by the United Nations and the World Bank.

(5)

The Union announced that it would provide up to EUR 500 million as financial assistance to Georgia.

(6)

Georgian economic adjustment and recovery is supported by financial assistance from the International Monetary Fund (IMF). In September 2008, the Georgian authorities agreed with the IMF on a Stand-By Arrangement of USD 750 million to support the Georgian economy in making the necessary adjustments in the light of the financial crisis.

(7)

Following a further deterioration of Georgia’s economic situation and a necessary revision of the underlying economic assumptions of the IMF programme as well as Georgia’s greater external financing needs, an agreement was reached between Georgia and the IMF for a loan increase of USD 424 million under the Stand-By Arrangement, which was approved in August 2009 by the IMF Board.

(8)

The Union allocated, for 2010-2012, under the European Neighbourhood and Partnership Instrument (ENPI), budget support grants to Georgia of, on average, EUR 24 million per year.

(9)

In view of Georgia’s deteriorating economic situation and outlook, it has requested Union macro-financial assistance.

(10)

Given that there is still a residual financing gap in Georgia’s balance of payments, macro-financial assistance is considered an appropriate response to Georgia’s request under the current exceptional circumstances to support economic stabilisation in conjunction with the current IMF programme.

(11)

The Union macro-financial assistance to be provided to Georgia (‘the Union’s macro-financial assistance’) should not merely supplement programmes and resources from the IMF and the World Bank, but should ensure the added value of Union involvement.

(12)

The Commission should ensure that the Union’s macro-financial assistance is legally and substantially in line with the measures taken within the different areas of external action and other relevant Union policies.

(13)

The specific objectives of the Union’s macro-financial assistance should strengthen efficiency, transparency and accountability. Those objectives should be regularly monitored by the Commission.

(14)

The conditions underlying the provision of the Union’s macro-financial assistance should reflect the key principles and objectives of the Union’s policy towards Georgia.

(15)

In order to ensure efficient protection of the Union’s financial interests linked to the Union’s macro-financial assistance, it is necessary that Georgia adopt appropriate measures relating to the prevention of, and the fight against, fraud, corruption and any other irregularities linked to that assistance. It is also necessary that the Commission provide for appropriate checks and that the Court of Auditors provide for appropriate audits.

(16)

The release of the Union’s macro-financial assistance is without prejudice to the powers of the budgetary authority.

(17)

The Union’s macro-financial assistance should be managed by the Commission. In order to ensure that the European Parliament and the Economic and Financial Committee are able to follow the implementation of this Decision, the Commission should regularly inform them of developments relating to the Union’s macro-financial assistance and provide them with relevant documents.

(18)

In order to ensure uniform conditions for the implementation of this Decision, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers (3).

(19)

In this context, it is recalled that in the terms of that Regulation the advisory procedure should, as a general rule, apply in all cases other than as provided for in that Regulation. Considering the potentially important impact of the operations superior to the threshold of EUR 90 million, it is appropriate that the examination procedure is used for these operations. Considering the amount of the Union’s macro-financial assistance to Georgia, the advisory procedure should apply for the adoption of the Memorandum of Understanding, or for reducing, suspending or cancelling of the assistance,

14.8.2013   

EN

Official Journal of the European Union

L 218/24

(1)

Implementing Regulation (EU) No 543/2011 lays down, pursuant to the outcome of the Uruguay Round multilateral trade negotiations, the criteria whereby the Commission fixes the standard values for imports from third countries, in respect of the products and periods stipulated in Annex XVI, Part A thereto.

(2)

The standard import value is calculated each working day, in accordance with Article 136(1) of Implementing Regulation (EU) No 543/2011, taking into account variable daily data. Therefore this Regulation should enter into force on the day of its publication in the Official Journal of the European Union,

14.8.2013   

EN

Official Journal of the European Union

L 218/26

(1)

Article 103n of Regulation (EC) No 1234/2007 provides that the allocation of the available Union funds as well as the budgetary limits for the national support programmes in the wine sector are set out in Annex Xb to that Regulation.

(2)

Pursuant to Article 103o of Regulation (EC) No 1234/2007, Member States had the possibility to decide, by 1 December 2012, to provide support to vine-growers for the financial year 2014 by allocating payment entitelments within the meaning of Chapter 1 of Title III of Council Regulation (EC) No 73/2009 of 19 January 2009 establishing common rules for direct support schemes for farmers under the common agricultural policy and establishing certain support schemes for farmers (2).

(3)

Member States intending to provide support in accordance with Article 103o of Regulation (EC) No 1234/2007 have notified the corresponding amounts. For the sake of clarity, the Commission should publish those amounts.

(4)

The measures provided for in this Decision are in accordance with the opinion of the Management Committee for the Common Organisation of Agricultural Markets,

14.8.2013   

EN

Official Journal of the European Union

L 218/28

(1)

In accordance with Article 80(1)(a) of Regulation (EC) No 1107/2009, Directive 91/414/EEC shall continue to apply to active substances for which a decision has been adopted in accordance with Article 6(3) of Directive 91/414/EEC before 14 June 2011.

(2)

In accordance with Article 6(2) of Directive 91/414/EEC, in February 2002 Portugal received an application from ISAGRO IT for the inclusion of the active substance benalaxyl-M in Annex I to Directive 91/414/EEC. Commission Decision 2003/35/EC (3) confirmed that the dossier was complete and could be considered as satisfying, in principle, the data and information requirements of Annexes II and III to that Directive.

(3)

In accordance with Article 6(2) of Directive 91/414/EEC, in September 2005 Hungary received an application from ISAGRO SpA for the inclusion of the active substance valifenalate in Annex I to Directive 91/414/EEC. Commission Decision 2006/586/EC (4) confirmed that the dossier was complete and could be considered as satisfying, in principle, the data and information requirements of Annexes II and III to that Directive.

(4)

Confirmation of the completeness of the dossiers was necessary in order to allow them to be examined in detail and to allow Member States the possibility of granting provisional authorisations, for periods of up to three years, for plant protection products containing the active substances concerned, while complying with the conditions laid down in Article 8(1) of Directive 91/414/EEC and, in particular, the conditions relating to the detailed assessment of the active substances and the plant protection products in the light of the requirements laid down by that Directive.

(5)

For these active substances, the effects on human health and the environment have been assessed, in accordance with the provisions of Article 6(2) and (4) of Directive 91/414/EEC, for the uses proposed by the applicants. The rapporteur Member States submitted the respective draft assessment reports to the Commission on 21 November 2003 (benalaxyl-M) and on 19 February 2008 (valifenalate).

(6)

Following submission of the draft assessment reports by the rapporteur Member States, it has been found to be necessary to request further information from the applicants and to have the rapporteur Member States examine that information and submit their assessment. Therefore, the examination of the dossiers is still ongoing and it will not be possible to complete the evaluation within the timeframe provided for in Directive 91/414/EEC, read in conjunction with Commission Implementing Decision 2011/671/EU (5).

(7)

As the evaluation so far has not identified any reason for immediate concern, Member States should be given the possibility of prolonging provisional authorisations granted for plant protection products containing the active substances concerned for a period of 24 months in accordance with the provisions of Article 8 of Directive 91/414/EEC so as to enable the examination of the dossiers to continue. It is expected that the evaluation and decision-making process with respect to a decision on a possible approval in accordance with Article 13(2) of Regulation (EC) No 1107/2009 for benalaxyl-M and valifenalate will have been completed within 24 months.

(8)

The measures provided for in this Decision are in accordance with the opinion of the Standing Committee on the Food Chain and Animal Health,

14.8.2013   

EN

Official Journal of the European Union

L 218/s3

14.8.2013   

EN

Official Journal of the European Union

L 218/s3