Commission Implementing Regulation (EU) 2018/574Show full title

Commission Implementing Regulation (EU) 2018/574 of 15 December 2017 on technical standards for the establishment and operation of a traceability system for tobacco products (Text with EEA relevance)

CHAPTER VU.K. [F1DATA REPOSITORY]

Article 24U.K.Components of the [F2data repository]

1.The [F3data repository] shall be composed of the following sub-systems:

(a)[F4a repository which is] established for the purpose of storing data relating to tobacco products of individual manufacturers and importers F5...;

F6(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c)a routing service (‘router’) set up and managed by the provider of the [F7data repository].

2.The sub-systems referred to in paragraph 1 shall be fully interoperable with one another F8....

Textual Amendments

Article 25U.K.General characteristics of the [F9data repository]

1.The [F10data repository] shall satisfy the following conditions:

F11(a). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b)it shall allow for electronic identification and authentication of tobacco products, at unit packet and aggregation level, in accordance with the requirements set out in this Regulation;

(c)it shall allow for automatic deactivation of unique identifiers in accordance with the rules set out in Article 5;

(d)it shall ensure electronic receipt and storing of information recorded and sent to the [F12data repository] by economic operators and [F13the ID issuer], in accordance with the requirements of this Regulation;

(e)it shall ensure storage of data for a minimum period of five years as of the moment the data are uploaded into the [F14data repository];

(f)it shall allow for automatic status messaging to economic operators, and to [F15HMRC] as requested, such as in the event of success, error or changes related to reporting activities, in accordance with the requirements of this Regulation;

(g)it shall allow for automatic validation of messages received from economic operators, including refusal of incorrect or incomplete messages, in particular reporting activities related to non-registered or duplicated unique identifiers, whereby the [F16data repository] shall store the information concerning any refused message;

(h)it shall ensure messaging between all of its components which shall take place instantaneously, in accordance with the requirements of this Regulation, in particular the overall response time of the [F17data repository] in sending acknowledgment messages, not considering the speed of the internet connection of the end user, which shall be no more than 60 seconds;

(i)it shall ensure continuous availability of all components and services with a monthly uptime of at least 99,5 % and sufficient back-up mechanisms in place;

(j)it shall be guarded by security procedures and systems ensuring that access to the [F18data repository] and download of the data stored therein is only granted to persons authorised according to this Regulation;

[F19(k)it must be accessible by HMRC. Administrators designated by the Commissioners must be granted access rights enabling them to create, manage, and withdraw user access rights for the data repository. Administrators designated by the Commissioners must be able to grant subsequent access rights to other users under their responsibility;]

(l)it shall enable [F20HMRC] to carry out downloads of full and selected sets of data stored in [F21the data repository];

(m)it shall maintain a complete record (‘audit trail’) of all operations concerning the stored data of the users performing those operations and of the nature of these operations, including the history of users access. The audit trail shall be created when the data is uploaded for the first time and, notwithstanding any additional national requirements, be maintained until at least five years after.

2.Data stored in the [F22data repository] shall be used only for the purposes referred to in F23... this Regulation.

Textual Amendments

Article 26U.K.[F24The data repository: establishment]

1.[F25The service provider appointed by the Commissioners] shall ensure the establishment of a [F26data repository]. F27...

2.[F28The data repository] shall exclusively host information which relates to the tobacco products of [F29manufacturers and importers].

F303.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F304.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5.[F31The data repository] shall store the data in accordance with the common data dictionary [F32established under Article 28(2)].

6.[F33HMRC] shall be able to carry out basic query requests in relation to all data stored in [F34the data] repository.

Textual Amendments

Article 27U.K.[F35The data repository: technical requirements]

F361.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.The [F37data] repository shall provide for graphical and non-graphical user interfaces that enable [F38HMRC] to access and query the data stored in the [F39data repository], using all commonly available database search functions, in particular by remotely carrying out the following operations:

(a)retrieval of any information concerning one or multiple unique identifier(s), including the comparison and cross-checking of multiple unique identifiers and the related information, in particular their location in the supply chain;

(b)creation of lists and statistics, such as product stocks and inflow/outflow numbers, associated with one or multiple elements of reporting information listed as Data Fields in Annex II;

(c)identification of all tobacco products that have been reported by an economic operator to the [F40data repository], including the products reported as recalled, withdrawn, stolen, missing or intended for destruction.

3.The user interfaces referred to in paragraph 2 shall enable [F41HMRC] to define individual rules for:

(a)automatic alerting based on exceptions and specific reporting events, such as abrupt fluctuations or irregularities in trade, attempts to introduce duplicate unique identifiers into the system, deactivation of the identifiers referred to in Articles 15(4), 17(4) and 19(4), or where a product is indicated by economic operators as stolen or missing;

(b)the receipt of periodic reports based on any combination of the elements of reporting information listed as Data Field in Annex II.

4.Automatic alerts and periodic reports referred to in paragraph 3 shall be forwarded to recipient addresses indicated by [F42HMRC] such as individual email addresses and/or internet Protocol (IP) addresses belonging to external systems used and managed by [F43HMRC].

5.The user interfaces referred to in paragraph 2 shall enable [F44HMRC] to connect remotely to the data stored in the [F45data repository] with the analytical software of their choice.

6.The user interfaces referred to in paragraph 2 shall be provided in [F46English].

7.The overall response time of the repository to any given query or alert trigger, not considering the speed of the internet connection of the end user, shall be no more than 5 seconds for the data stored for less than 2 years and no more than 10 seconds for the data stored for 2 years or more, in at least 99 % of all queries and automatic alerts foreseen under paragraphs 2 and 3.

8.The overall time between the arrival of reporting activity data and its accessibility, via the graphical and non-graphical interfaces, in the [F47data repository] shall be no more than 60 seconds in at least 99 % of all data transfer activities.

9.The repository shall allow for the receipt, storing and making available of offline flat-files for the purpose of updating verification devices used by [F48HMRC] for offline decoding of unique identifiers.

10.The provider of the [F49data] repository shall establish and maintain a register of the information transferred to it in accordance with Article 20(3). A record of the information stored in the register shall be kept for as long as the traceability system is operational.

11.[F50The Commissioners] retain the right to enter into additional service level agreements with the provider of the [F51data] repository for the purpose of contracting the latter to carry out additional services not provided for by this Regulation. The provider of the [F51data] repository may charge proportionate fees for providing such additional services.

F5212.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

Article 28U.K.Coordination tasks of the provider of the [F53data] repository

1.The provider operating the [F54data] repository shall communicate to [F55the ID issuer] and economic operators, the list of specifications required for the data exchange with the [F54data] repository and the router. All specifications shall be based on non-proprietary open standards.

The list referred to in the first subparagraph shall be communicated no later than two months following the date when the provider operating the [F54data] repository was selected.

2.On the basis of the information listed in Annex II, the provider operating the [F56data] repository shall establish a common data dictionary. The common data dictionary shall refer to labels of data fields in the human readable format. F57....

3.Whenever necessary to ensure the effective operation of the [F58data repository] in accordance with the requirements of this Regulation, the provider operating the [F59data] repository shall update the list referred to in paragraph 1 F60....

Textual Amendments

Article 29U.K.Router

1.The provider of the [F61data] repository shall set up and manage a router.

2.Data exchange between the router and the [F62data repository] shall take place using the data format and data exchange modalities defined by the router.

3.Data exchange between the router and [F63the ID Issuer] shall take place using the data format and data exchange modalities defined by the router.

4.Economic operators F64... shall send the information recorded F65... in accordance with this Regulation to the router, which F66... shall be transferred instantaneously to the [F67data repository].

Textual Amendments

Article 30U.K.Costs of the [F68data repository]

1.All costs related to the [F69data repository] referred to in Article 24(1), including those that arise from its establishment, operation and maintenance, shall be borne by manufacturers and importers of tobacco products. Those costs shall be fair, reasonable, and proportionate:

(a)to the services rendered; and

(b)to the amount of unit level UIs requested over a given period of time.

2.The costs, as applicable, of establishing, operating and maintaining the [F70data] repository and the router shall be transmitted to manufacturers and importers of tobacco products through the costs charged to them by the [F71provider of the data repository].

F72Article 31U.K.Deadline for the establishment of the repositories system

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .