CHAPTER V F1DATA REPOSITORY
Article 24Components of the F2data repository
1.
The F3data repository shall be composed of the following sub-systems:
(a)
F6(b)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(c)
a routing service (‘router’) set up and managed by the provider of the F7data repository.
2.
The sub-systems referred to in paragraph 1 shall be fully interoperable with one another F8....
Article 25General characteristics of the F9data repository
1.
The F10data repository shall satisfy the following conditions:
F11(a)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(b)
it shall allow for electronic identification and authentication of tobacco products, at unit packet and aggregation level, in accordance with the requirements set out in this Regulation;
(c)
it shall allow for automatic deactivation of unique identifiers in accordance with the rules set out in Article 5;
(d)
(e)
it shall ensure storage of data for a minimum period of five years as of the moment the data are uploaded into the F14data repository;
(f)
it shall allow for automatic status messaging to economic operators, and to F15HMRC as requested, such as in the event of success, error or changes related to reporting activities, in accordance with the requirements of this Regulation;
(g)
it shall allow for automatic validation of messages received from economic operators, including refusal of incorrect or incomplete messages, in particular reporting activities related to non-registered or duplicated unique identifiers, whereby the F16data repository shall store the information concerning any refused message;
(h)
it shall ensure messaging between all of its components which shall take place instantaneously, in accordance with the requirements of this Regulation, in particular the overall response time of the F17data repository in sending acknowledgment messages, not considering the speed of the internet connection of the end user, which shall be no more than 60 seconds;
(i)
it shall ensure continuous availability of all components and services with a monthly uptime of at least 99,5 % and sufficient back-up mechanisms in place;
(j)
it shall be guarded by security procedures and systems ensuring that access to the F18data repository and download of the data stored therein is only granted to persons authorised according to this Regulation;
F19(k)
it must be accessible by HMRC. Administrators designated by the Commissioners must be granted access rights enabling them to create, manage, and withdraw user access rights for the data repository. Administrators designated by the Commissioners must be able to grant subsequent access rights to other users under their responsibility;
(l)
(m)
it shall maintain a complete record (‘audit trail’) of all operations concerning the stored data of the users performing those operations and of the nature of these operations, including the history of users access. The audit trail shall be created when the data is uploaded for the first time and, notwithstanding any additional national requirements, be maintained until at least five years after.
2.
Article 26F24The data repository: establishment
1.
2.
F303.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F304.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.
6.
Article 27F35The data repository: technical requirements
F361.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.
The F37data repository shall provide for graphical and non-graphical user interfaces that enable F38HMRC to access and query the data stored in the F39data repository, using all commonly available database search functions, in particular by remotely carrying out the following operations:
(a)
retrieval of any information concerning one or multiple unique identifier(s), including the comparison and cross-checking of multiple unique identifiers and the related information, in particular their location in the supply chain;
(b)
creation of lists and statistics, such as product stocks and inflow/outflow numbers, associated with one or multiple elements of reporting information listed as Data Fields in Annex II;
(c)
identification of all tobacco products that have been reported by an economic operator to the F40data repository, including the products reported as recalled, withdrawn, stolen, missing or intended for destruction.
3.
The user interfaces referred to in paragraph 2 shall enable F41HMRC to define individual rules for:
(a)
automatic alerting based on exceptions and specific reporting events, such as abrupt fluctuations or irregularities in trade, attempts to introduce duplicate unique identifiers into the system, deactivation of the identifiers referred to in Articles 15(4), 17(4) and 19(4), or where a product is indicated by economic operators as stolen or missing;
(b)
the receipt of periodic reports based on any combination of the elements of reporting information listed as Data Field in Annex II.
4.
5.
6.
The user interfaces referred to in paragraph 2 shall be provided in F46English.
7.
The overall response time of the repository to any given query or alert trigger, not considering the speed of the internet connection of the end user, shall be no more than 5 seconds for the data stored for less than 2 years and no more than 10 seconds for the data stored for 2 years or more, in at least 99 % of all queries and automatic alerts foreseen under paragraphs 2 and 3.
8.
The overall time between the arrival of reporting activity data and its accessibility, via the graphical and non-graphical interfaces, in the F47data repository shall be no more than 60 seconds in at least 99 % of all data transfer activities.
9.
The repository shall allow for the receipt, storing and making available of offline flat-files for the purpose of updating verification devices used by F48HMRC for offline decoding of unique identifiers.
10.
The provider of the F49data repository shall establish and maintain a register of the information transferred to it in accordance with Article 20(3). A record of the information stored in the register shall be kept for as long as the traceability system is operational.
11.
F50The Commissioners retain the right to enter into additional service level agreements with the provider of the F51data repository for the purpose of contracting the latter to carry out additional services not provided for by this Regulation. The provider of the F51data repository may charge proportionate fees for providing such additional services.
F5212.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Article 28Coordination tasks of the provider of the F53data repository
1.
The provider operating the F54data repository shall communicate to F55the ID issuer and economic operators, the list of specifications required for the data exchange with the F54data repository and the router. All specifications shall be based on non-proprietary open standards.
The list referred to in the first subparagraph shall be communicated no later than two months following the date when the provider operating the F54data repository was selected.
2.
3.
Article 29Router
1.
The provider of the F61data repository shall set up and manage a router.
2.
Data exchange between the router and the F62data repository shall take place using the data format and data exchange modalities defined by the router.
3.
Data exchange between the router and F63the ID Issuer shall take place using the data format and data exchange modalities defined by the router.
4.
Article 30Costs of the F68data repository
1.
All costs related to the F69data repository referred to in Article 24(1), including those that arise from its establishment, operation and maintenance, shall be borne by manufacturers and importers of tobacco products. Those costs shall be fair, reasonable, and proportionate:
(a)
to the services rendered; and
(b)
to the amount of unit level UIs requested over a given period of time.
2.
F72Article 31Deadline for the establishment of the repositories system
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .