(1)

Decision (EU) 2017/1324 of the European Parliament and of the Council (2) provides for the participation of the Union in the Partnership for Research and Innovation in the Mediterranean Area (‘PRIMA’) jointly undertaken by several Member States.

(2)

The Kingdom of Morocco (‘Morocco’) has expressed its wish to join PRIMA as a Participating State and to be on an equal footing with the Member States and third countries associated with Horizon 2020 — the Framework Programme for Research and Innovation (2014-2020) — that participate in PRIMA.

(3)

In accordance with Article 1(2) of Decision (EU) 2017/1324, Morocco is to become a Participating State in PRIMA subject to the conclusion of an international agreement for scientific and technological cooperation with the Union setting out the terms and conditions for the participation of Morocco in PRIMA.

(4)

In accordance with Council Decision (EU) 2018/639 (3), the Agreement for scientific and technological cooperation between the European Union and the Kingdom of Morocco setting out the terms and conditions for the participation of the Kingdom of Morocco in the Partnership for Research and Innovation in the Mediterranean Area (PRIMA) (‘the Agreement’) was signed on 10 April 2018, subject to its conclusion at a later date.

(5)

The Agreement should be approved,

(1)

Council Regulation (EU) 2019/124 (1) fixes the fishing opportunities for 2019 for certain fish stocks and groups of fish stocks, applicable in Union waters and, for Union vessels, in certain non-Union waters.

(2)

At its annual meeting in 2018, the Western and Central Pacific Fisheries Commission (WCPFC) maintained conservation measures for swordfish and tropical tunas. Those measures should be implemented in the law of the Union.

(3)

At its annual meeting in 2019, the South Pacific Regional Fisheries Management Organisation (SPRFMO) adopted new catch limits for jack mackerel (Trachurus murphyi) and approved exploratory fisheries for toothfish (Dissostichus spp.). The applicable measures should be implemented in the law of the Union.

(4)

In Regulation (EU) 2019/124, the total allowable catch (TAC) for sandeel in the International Council for the Exploration of the Sea (ICES) divisions 2a and 3a and ICES subarea 4 was set at zero. Sandeel is a short-lived species and the relevant scientific advice becomes available in the second half of February, while the fishing activities start in April.

(5)

The catch limits for sandeel in ICES divisions 2a and 3a and ICES subarea 4 should be amended in line with the latest scientific advice from the ICES, issued on 22 February 2019, for the maximum sustainable yield approach and, for certain management areas, for the precautionary approach.

(6)

Effort limits for Union fishing vessels in the International Commission for the Conservation of Atlantic Tunas (ICCAT) Convention Area are based on information provided in the fishing, capacity and farming plans for bluefin tuna communicated by Member States to the Commission. Those effort limits were reported through the Union plan endorsed by ICCAT during the Intersessional meeting of Panel 2 held on 4 and 5 March 2019. They should be established as part of the fishing opportunities.

(7)

Regulation (EU) 2019/124 should therefore be amended accordingly.

(8)

The catch limits provided for in Regulation (EU) 2019/124 apply from 1 January 2019. The provisions introduced by this Regulation concerning catch limits should therefore also apply from that date. Such retroactive application is without prejudice to the principles of legal certainty and protection of legitimate expectations as the fishing opportunities concerned have not yet been exhausted,

(1)

Article 27(2) is replaced by the following:

(2)

the following Article is inserted:

(3)

Annexes IA, IB, IH, IJ, III, IV, VII and VIII to Regulation (EU) 2019/124 are amended in accordance with the Annex to this Regulation.

(1)

Commission Delegated Regulation (EU) 2018/631 (2) established European Union reference laboratories (‘EURLs’) for pests of plants on insects and mites, nematodes, bacteria, fungi and oomycetes, and viruses, viroids and phytoplasmas.

(2)

Following the establishment of those EURLs, the Commission carried out a public selection process for the designation of EURLs for pests of plants on insects and mites, nematodes, bacteria, fungi and oomycetes, and viruses, viroids and phytoplasmas

(3)

The consortium led by the French Agency for Food, Environmental and Occupational Health and Safety (ANSES), which also comprises the Austrian Agency for Health and Food Safety (AGES), applied for the selection process for the designation as EURL for pests of plants on insects and mites.

(4)

The consortium led by the French Agency for Food, Environmental and Occupational Health and Safety (ANSES), which also comprises the Flanders Research Institute for Agriculture, Fisheries and Food (ILVO, Belgium), applied for the selection process for the designation as EURL for pests of plants on nematodes.

(5)

The consortium led by the Netherlands Food and Consumer Product Safety Authority-National Reference Centre Plant Health (NVWA-NRC), which also comprises the Flanders Research Institute for Agriculture, Fisheries and Food (ILVO, Belgium), the Research Centre for Plant Protection and Certification (CREA-DC (DIALAB), Italy), and the National Institute of Biology (NIB, Slovenia) applied for the selection process for the designation as EURL for pests of plants on bacteria.

(6)

The French Agency for Food, Environmental and Occupational Health and Safety (ANSES) applied for the selection process for the designation as EURL for pests of plants on fungi and oomycetes.

(7)

The consortium led by the Netherlands Food and Consumer Product Safety Authority-National Reference Centre Plant Health (NVWA-NRC), which also comprises the Research Centre for Plant Protection and Certification (CREA-DC (DIALAB), Italy), and the National Institute of Biology (NIB, Slovenia), applied for the selection process for the designation as EURL for pests of plants on viruses, viroids and phytoplasmas.

(8)

The evaluation and selection committee appointed for the selection process concluded that all those consortia and laboratories comply with the requirements set out in Article 93(3) of Regulation (EU) 2017/625 and could be responsible for the tasks set out in Article 94 of that Regulation.

(9)

Those four consortia and that laboratory should therefore be designated as EURLs for the respective pests of plants on insects and mites, nematodes, bacteria, fungi and oomycetes, and viruses, viroids and phytoplasmas. Their work programmes should be established in conformity with the objectives and priorities of the relevant work programmes adopted by the Commission in accordance with Article 36 of Regulation (EU) No 652/2014 of the European Parliament and of the Council (3).

(10)

In order to ensure that the appropriate level of methods of analysis, test or diagnosis, and the development of validated methods and the coordinated assistance of the official laboratories is maintained, and in accordance with point (b) of Article 93(2) of Regulation (EU) 2017/625, the designation as EURLs should be reviewed regularly,

Consortium led by the French Agency for Food, Environmental and Occupational Health and Safety (ANSES, Plant Health Laboratory, Entomology and Invasive Plants Unit, 755 avenue du campus Agropolis, CS 30016, 34988 Montferrier-sur-Lez cedex, France),

and also composed of:

the Austrian Agency for Health and Food Safety (AGES, Institute for Sustainable Plant Production, Spargelfeldstraße 191, 1220 Vienna, Austria).

Consortium led by the French Agency for Food, Environmental and Occupational Health and Safety (ANSES, Plant Health Laboratory, Nematology Unit, Domaine de la Motte au Vicomte — BP 35327, 35653 Le Rheu, France),

and also composed of:

the Flanders Research Institute for Agriculture, Fisheries and Food (ILVO, Plant Sciences, Nematology group, Burg. Van Gansberghelaan 96, 9820 Merelbeke, Belgium).

and also composed of:

the French Agency for Food, Environmental and Occupational Health and Safety (ANSES, Plant Health Laboratory, Mycology Unit, Domaine de Pixérécourt, CS 400009, 54220 Malzéville, France).

and also composed of:

(1)

Commission Regulation (EC) No 1484/95 (3) lays down detailed rules for implementing the system of additional import duties and fixes representative prices in the poultrymeat and egg sectors and for egg albumin.

(2)

Regular monitoring of the data used to determine representative prices for poultrymeat and egg products and for egg albumin shows that the representative import prices for certain products should be amended to take account of variations in price according to origin.

(3)

Regulation (EC) No 1484/95 should therefore be amended accordingly.

(4)

Given the need to ensure that this measure applies as soon as possible after the updated data have been made available, this Regulation should enter into force on the day of its publication,

(1)

Directive 2011/16/EU as amended by Council Directive (EU) 2018/822 (2) provides for mandatory automatic exchange of information on reportable cross-border arrangements. A standard form, including linguistic arrangements, should be used for those exchanges.

(2)

Commission Implementing Regulation (EU) 2015/2378 (3) should therefore be amended in order to provide for such a standard form.

(3)

The second subparagraph of Article 20(5) of Directive 2011/16/EU provides that the standard form shall not exceed the components for the exchange of information listed in Article 8ab(14) of Directive 2011/16/EU, and such other related fields which are linked to these components and are necessary to achieve the objectives of Article 8ab of that Directive. In order to ensure that the mandatory automatic exchange of information on reportable cross-border arrangements is effective, especially where more than one intermediary or relevant taxpayer is liable to file information, it is critical to include an additional field containing a reference number of the reportable cross-border arrangement. If more than one intermediary or relevant taxpayer is obliged to file information, one single reference number should feature on all exchanges of the same arrangement so that these exchanges can be linked to a single arrangement on the central directory.

(4)

For reasons of coherence and legal certainty, the date of application of this Regulation should be aligned with the date of application provided for in the second subparagraph of Article 2(1) of Directive (EU) 2018/822.

(5)

The measures provided for in this Regulation are in accordance with the opinion of the Committee on administrative cooperation for taxation,

(1)

the following Article 2e is inserted:

(2)

Annex to this Regulation is added as Annex XIII.

(1)

By Commission Regulation (EC) No 1213/2008 (2) a first coordinated multiannual Community control programme, covering the years 2009, 2010 and 2011, was established. That programme continued under consecutive Commission Regulations. The latest one was Commission Implementing Regulation (EU) 2018/555 (3).

(2)

Thirty to forty foodstuffs constitute the major components of the diet in the Union. Since pesticide uses show significant changes over a period of three years, pesticides should be monitored in those foodstuffs over a series of three-year cycles to allow consumer exposure and the application of Union legislation to be assessed.

(3)

The European Food Safety Authority (‘the Authority’), submitted a scientific report on a design assessment of the pesticide monitoring programme. It concluded that an MRL exceedance rate above 1 % could be estimated with a margin of error of 0,75 % by selecting 683 sample units for a minimum of 32 different food items (4). Collection of those samples should be apportioned among Member States according to population numbers, with a minimum of 12 samples per product and per year.

(4)

Analytical results from the previous official control programmes of the Union have been taken into account to ensure that the range of pesticides covered by the control programme is representative for the pesticides used.

(5)

Guidance concerning ‘Analytical quality control and validation procedures for pesticide residues analysis in food and feed’ is published on the Commission website (5).

(6)

Where the residue definition of a pesticide includes other active substances, metabolites and/or breakdown or reaction products, those compounds should be reported separately as far as they are measured individually (6).

(7)

Implementing measures, such as the Standard Sample Description (SSD) for submitting results of pesticide residues analysis, relating to the submission of information by Member States have been agreed by Member States, the Commission and the Authority.

(8)

For the sampling procedures, Commission Directive 2002/63/EC (7), which incorporates the sampling methods and procedures recommended by the Codex Alimentarius Commission, should apply.

(9)

It is necessary to assess whether maximum residue levels for food for infants and young children provided for in Article 10 of Commission Directive 2006/141/EC (8) and Article 7 of Commission Directive 2006/125/EC (9) are respected, taking into account only the residue definitions as they are set out in Regulation (EC) No 396/2005.

(10)

As regards single residue methods, Member States may be able to meet their obligations of analysis by having recourse to official laboratories already having the validated methods required.

(11)

Member States should submit by 31 August of each year the information concerning the previous calendar year.

(12)

In order to avoid any confusion due to an overlap between consecutive multiannual programmes, Implementing Regulation (EU) 2018/555 should be repealed in the interest of legal certainty. It should, however, continue to apply to samples tested in 2019.

(13)

The measures provided for in this Regulation are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed,

(1)

The Commission has recognised 5th generation (5G) deployment of network technologies as a major enabler for future digital services and a priority for the Digital Single Market strategy. The Commission adopted the 5G Action Plan to make sure that the Union has the connectivity infrastructure necessary for its digital transformation from 2020 (1).

(2)

5G networks will build on the current 4th generation (4G) of network technologies, by providing new service capabilities and becoming the central infrastructure and enabler for large parts of the Union economy. Once rolled out, 5G networks will form the backbone for a wide range of services essential for the functioning of the internal market and the maintenance and operation of vital societal and economic functions – such as energy, transport, banking, and health, as well as industrial control systems. The organisation of democratic processes, such elections, will also rely more and more on digital infrastructure and 5G networks.

(3)

The dependence of many critical services on 5G networks would make the consequences of systemic and widespread disruption particularly serious. As a result, ensuring the cybersecurity of 5G networks is an issue of strategic importance for the Union, at a time when cyber-attacks are on the rise and more sophisticated than ever.

(4)

The interconnected and transnational nature of the infrastructures underpinning the digital ecosystem, and the cross-border nature of the threats involved, mean that any significant vulnerabilities and/or cybersecurity incidents concerning 5G networks happening in one Member State would affect the Union as a whole. This is why measures should be provided to underpin a high common level of cybersecurity of 5G networks.

(5)

The need for action at Union level has been confirmed by the Member States. In its conclusions of 21 March 2019, the European Council looked forward to a Commission recommendation on a concerted approach to the security of 5G networks (2).

(6)

Ensuring European sovereignty should be a major objective, in full respect of Europe's values of openness and tolerance (3). Foreign investment in strategic sectors, acquisition of critical assets, technologies and infrastructure in the Union and supply of critical equipment may also pose risks to the Union's security.

(7)

The cybersecurity of 5G networks is key for ensuring the strategic autonomy of the Union, as recognised in the Joint Communication ‘EU-China, a Strategic Outlook’ (4).

(8)

The European Parliament's resolution on security threats connected with the rising Chinese technological presence in the Union also calls on the Commission and Member States to take action at Union level (5).

(9)

This Recommendation addresses cybersecurity risks in 5G networks by setting out guidance on appropriate risk analysis and management measures at national level, on developing a coordinated European risk assessment and on establishing a process to develop a common toolbox of best risk management measures.

(10)

There is a strong Union legislative framework in place to protect electronic communications networks.

(11)

The Union's framework in the field of electronic communications (6) promotes competition, internal market and end-user interests and with the European Electronic Communications Code (7) pursues an additional connectivity objective, articulated in terms of outcomes: widespread access to and take-up of very high capacity fixed and mobile connectivity for all Union citizens and businesses while safeguarding the interests of the citizens. Directive 2002/21/EC requires Member States to ensure that the integrity and security of public communications networks are maintained, with obligations to ensure that undertakings providing public communications networks or publicly available electronic communications services take technical and organisational measures to appropriately manage the risks posed to security of networks and services. It also provides that competent national regulatory authorities have powers, including the power to issue binding instructions, to ensure compliance with such obligations.

(12)

In addition, Directive 2002/20/EC of the European Parliament and of the Council (8) allows Member States to attach conditions concerning the security of public networks against unauthorised access to the general authorisation, for the purpose of protecting the confidentiality of communications in accordance with Directive 2002/58/EC of the European Parliament and of the Council (9).

(13)

To support the implementation of these obligations, the Union has set up a number of cooperation bodies. The Agency for Network and Information Security (ENISA), the Commission, Member States and national regulatory authorities have developed technical guidelines for national regulatory authorities on incident reporting, security measures and threats and assets (10). The Cooperation Group established by Directive (EU) 2016/1148 of the European Parliament and of the Council (11) (‘the Cooperation Group’) brings together competent authorities in order to support and facilitate cooperation, in particular by providing strategic guidance for the activities of the Computer Security Incident Response Teams network, which at technical level facilitates operational cooperation.

(14)

The future European cybersecurity certification framework (12) should provide an essential supporting tool to promote consistent levels of security. It should allow for the development of cybersecurity certification schemes to respond to the needs of users of 5G-related equipment and software. The critical importance of these infrastructures should make the development of relevant European cybersecurity certification schemes for information and communications technologies' products, services or processes used for 5G networks an immediate priority. Member States and market players should actively engage in the development of such certification schemes, including providing support for the definition of specific protection profiles for 5G networks.

(15)

In the absence of harmonised Union law, Member States may specify by means of national technical regulations, adopted in compliance with Union law, that a European cybersecurity certification scheme should be mandatory. Member States also have recourse to European cybersecurity certification schemes in the context of public procurement and of Directive 2014/24/EU of the European Parliament and of the Council (13) and could support the development of assistance mechanisms – such as an assistance hub – for the purchase of cybersecurity solutions by public buyers.

(16)

A high level of data protection and privacy is an important element in ensuring the security of 5G networks. Rules have also been defined at Union level ensuring the security of processing of personal data, including in electronic communications. The General Data Protection Regulation (14) sets the obligation to process personal data in a manner that ensures its security, including for preventing unauthorised access to or use of personal data and the equipment used for the processing. The Directive on privacy and electronic communications lays down specific rules on the protection of confidentiality of communications and of the terminal equipment of end-users. It also imposes obligations on service providers to take appropriate technical and organisational measures to safeguard the security of their services.

(17)

The Union has also adopted an instrument that will protect critical infrastructure and technologies, such as those used in communications, by allowing Member States to screen foreign direct investments on grounds of security or public order and by creating a cooperation mechanism where Member States and the Commission will be able to exchange information and raise concerns related to specific investments (15).

(18)

Member States and operators are currently taking important preparatory steps towards enabling the large-scale roll-out of 5G networks. Several Member States have expressed concerns about potential security risks related to 5G networks in the context of carrying out procedures for the grant of rights of use in radio spectrum bands designated for 5G networks (16) — and have been exploring measures to address these risks.

(19)

Addressing cybersecurity risks in 5G networks should take into account both technical and other factors. Technical factors may include cybersecurity vulnerabilities that may be exploited to gain unauthorised access to information (cyberespionage, be it for economic or political reasons) or for other malicious purposes (cyberattacks aimed at disrupting or destroying systems and data). Important aspects to consider should be the need to protect the networks across their entire lifecycle and the need to cover all relevant equipment, including in the design, development, procurement, deployment, operation and maintenance phases of 5G networks.

(20)

Other factors may include regulatory or other requirements imposed on information and communications technologies equipment suppliers. An assessment of the significance of such factors would need to take into account, inter alia, the overall risk of influence by a third country, notably in relation to its model of governance, the absence of cooperation agreements on security, or similar arrangements, such as adequacy decisions, as regards data protection between the Union and the third country concerned, or whether this country is a party to multilateral, international or bilateral agreements on cybersecurity, the fight against cybercrime, or data protection.

(21)

As an important step in developing a Union approach to the cybersecurity of 5G networks, a risk assessment should be conducted and completed at national level. This would help Member States to adapt national measures on security requirements and risk management in the light of this assessment.

(22)

Coordination should be developed to ensure the effectiveness of measures aimed at addressing these cybersecurity threats, measures which are essential for the smooth functioning of the internal market and for the protection of personal data and privacy.

(23)

The national risk assessments should form the basis for a coordinated Union risk assessment, made up of a threat landscape mapping and a joint review to be conducted by the Member States, with support from the Commission and together with the European Agency for the Cybersecurity (ENISA).

(24)

Taking into account national and Union risk assessments, the Cooperation Group should establish a toolbox identifying types of cybersecurity risk and of possible measures to mitigate the risks in areas including certification, testing and access controls. It should also identify possible specific measures appropriate to address risks identified by one or more Member States. The Cooperation Group should draw on the support of the European Agency for Cybersecurity (ENISA), Europol, the Body of European Regulators for Electronic Communications (BEREC) and the EU Intelligence and Situation Centre. This toolbox should serve to advise the Commission on developing minimum common requirements to further ensure a high level of cybersecurity of 5G networks across the Union.

(25)

When measures are taken to address cybersecurity risks consideration should be given to the promotion of cybersecurity through diversity of suppliers when building any single network.

(26)

This Recommendation should be without prejudice to the competences of the Member States regarding activities concerning public security, defence, national security and the activities of the State in areas of criminal law, including the right of the Member States to exclude providers or suppliers from their markets for national security reasons.