Components of the repositories system
1. The repositories system shall be composed of the following sub-systems:
(a)
repositories which are established for the purpose of storing data relating to tobacco products of individual manufacturers and importers (‘primary repositories’);
(b)
a repository which contains a copy of all data stored in the primary repositories system (‘secondary repository’);
(c)
a routing service (‘router’) set up and managed by the provider of the secondary repository system.
2. The sub-systems referred to in paragraph 1 shall be fully interoperable with one another, irrespective of the service provider used.
General characteristics of the repositories system
1. The repositories system shall satisfy the following conditions:
(a)
it shall allow for functional integration of the repositories system into the traceability system, as well as uninterrupted electronic data exchange between the repositories system and other relevant components of the traceability system;
(b)
it shall allow for electronic identification and authentication of tobacco products, at unit packet and aggregation level, in accordance with the requirements set out in this Regulation;
(c)
it shall allow for automatic deactivation of unique identifiers in accordance with the rules set out in Article 5;
(d)
it shall ensure electronic receipt and storing of information recorded and sent to the repositories system by economic operators and ID issuers, in accordance with the requirements of this Regulation;
(e)
it shall ensure storage of data for a minimum period of five years as of the moment the data are uploaded into the repositories system;
(f)
it shall allow for automatic status messaging to economic operators, and to Member States and the Commission as requested, such as in the event of success, error or changes related to reporting activities, in accordance with the requirements of this Regulation;
(g)
it shall allow for automatic validation of messages received from economic operators, including refusal of incorrect or incomplete messages, in particular reporting activities related to non-registered or duplicated unique identifiers, whereby the repositories system shall store the information concerning any refused message;
(h)
it shall ensure messaging between all of its components which shall take place instantaneously, in accordance with the requirements of this Regulation, in particular the overall response time of the repositories system in sending acknowledgment messages, not considering the speed of the internet connection of the end user, which shall be no more than 60 seconds;
(i)
it shall ensure continuous availability of all components and services with a monthly uptime of at least 99,5 % and sufficient back-up mechanisms in place;
(j)
it shall be guarded by security procedures and systems ensuring that access to the repositories and download of the data stored therein is only granted to persons authorised according to this Regulation;
(k)
it shall be accessible by the competent authorities of Member States and by the Commission. National administrators designated by the Member States and Commission services shall be granted access rights enabling them to create, manage, and withdraw user access rights for repositories, and related operations stipulated in this Chapter, via a graphical user management interface. The graphical user management interface shall be compatible with Regulation (EU) No 910/2014, in particular the relevant reusable solutions provided as building blocks under the telecommunication part of the Connecting Europe Facility. National administrators designated by the Member States shall be able to grant subsequent access rights to other users under their responsibility;
(l)
it shall enable Member States and the Commission to carry out downloads of full and selected sets of data stored in a repository;
(m)
it shall maintain a complete record (‘audit trail’) of all operations concerning the stored data of the users performing those operations and of the nature of these operations, including the history of users access. The audit trail shall be created when the data is uploaded for the first time and, notwithstanding any additional national requirements, be maintained until at least five years after.
2. Data stored in the repositories system shall be used only for the purposes referred to in Directive 2014/40/EU and this Regulation.
Primary repositories
1. Each manufacturer and importer shall ensure the establishment of a primary repository. To that end each manufacturer and importer shall contract an independent third party provider, in accordance with the contractual requirements set out in Commission Delegated Regulation (EU) 2018/573 ( 7 ) . The selection of the independent third party shall take place in accordance with the procedural rules laid down in Annex I, Part A.
2. Each primary repository shall exclusively host information which relates to the tobacco products of the manufacturer or importer who contracted the repository.
3. Whenever data are received by the primary repository on the basis of a reporting activity, or for any other permitted reason, it shall be forwarded to the secondary repository instantaneously.
4. In forwarding all data received to the secondary repository, the primary repositories shall use the data format and data exchange modalities defined by the secondary repository.
5. Primary repositories shall store the data in accordance with the common data dictionary provided by the secondary repository.
6. Member States, the Commission, and external auditors approved by the Commission shall be able to carry out basic query requests in relation to all data stored in a primary repository.
Secondary repository
1. A single secondary repository containing a copy of all data stored in primary repositories shall be established. The operator of the secondary repository shall be appointed from among the providers of primary repositories in accordance with the procedure laid down in Annex I, Part B.
2. The secondary repository shall provide for graphical and non-graphical user interfaces that enable Member States and the Commission to access and query the data stored in the repositories system, using all commonly available database search functions, in particular by remotely carrying out the following operations:
(a)
retrieval of any information concerning one or multiple unique identifier(s), including the comparison and cross-checking of multiple unique identifiers and the related information, in particular their location in the supply chain;
(b)
creation of lists and statistics, such as product stocks and inflow/outflow numbers, associated with one or multiple elements of reporting information listed as Data Fields in Annex II;
(c)
identification of all tobacco products that have been reported by an economic operator to the system, including the products reported as recalled, withdrawn, stolen, missing or intended for destruction.
3. The user interfaces referred to in paragraph 2 shall enable each Member State and the Commission to define individual rules for:
(a)
automatic alerting based on exceptions and specific reporting events, such as abrupt fluctuations or irregularities in trade, attempts to introduce duplicate unique identifiers into the system, deactivation of the identifiers referred to in Articles 15(4), 17(4) and 19(4), or where a product is indicated by economic operators as stolen or missing;
(b)
the receipt of periodic reports based on any combination of the elements of reporting information listed as Data Field in Annex II.
4. Automatic alerts and periodic reports referred to in paragraph 3 shall be forwarded to recipient addresses indicated by Member States and the Commission such as individual email addresses and/or internet Protocol (IP) addresses belonging to external systems used and managed by national authorities or the Commission.
5. The user interfaces referred to in paragraph 2 shall enable Member States and the Commission to connect remotely to the data stored in the repositories system with the analytical software of their choice.
6. The user interfaces referred to in paragraph 2 shall be provided in the official languages of the Union.
7. The overall response time of the repository to any given query or alert trigger, not considering the speed of the internet connection of the end user, shall be no more than 5 seconds for the data stored for less than 2 years and no more than 10 seconds for the data stored for 2 years or more, in at least 99 % of all queries and automatic alerts foreseen under paragraphs 2 and 3.
8. The overall time between the arrival of reporting activity data and its accessibility, via the graphical and non-graphical interfaces, in the primary and secondary repositories shall be no more than 60 seconds in at least 99 % of all data transfer activities.
9. The repository shall allow for the receipt, storing and making available of offline flat-files for the purpose of updating verification devices used by Member States for offline decoding of unique identifiers.
10. The provider of the secondary repository shall establish and maintain a register of the information transferred to it in accordance with Article 20(3). A record of the information stored in the register shall be kept for as long as the traceability system is operational.
11. Member States and the Commission shall retain the right to enter into additional service level agreements with the provider of the secondary repository for the purpose of contracting the latter to carry out additional services not provided for by this Regulation. The provider of the secondary repository may charge proportionate fees for providing such additional services.
12. The repository services provided to Member States and the Commission under this Article shall be compatible with Regulation (EU) No 910/2014 and in particular allow for the use of reusable solutions provided as building blocks under the telecommunication part of the Connecting Europe Facility.
Coordination tasks of the provider of the secondary repository
1. The provider operating the secondary repository shall communicate to providers operating primary repositories, ID issuers and economic operators, the list of specifications required for the data exchange with the secondary repository and the router. All specifications shall be based on non-proprietary open standards.
The list referred to in the first subparagraph shall be communicated no later than two months following the date when the provider operating the secondary repository was selected.
2. On the basis of the information listed in Annex II, the provider operating the secondary repository shall establish a common data dictionary. The common data dictionary shall refer to labels of data fields in the human readable format. The common data dictionary shall be communicated to the providers operating primary repositories no later than two months following the date when the provider operating the secondary repository was selected.
3. Whenever necessary to ensure the effective operation of the repositories system in accordance with the requirements of this Regulation, the provider operating the secondary repository shall update the list referred to in paragraph 1 and the common data dictionary referred to in paragraph 2. Any such update shall be communicated to the providers operating primary repositories at least two months prior to the date of implementing the update into the system.
Router
1. The provider of the secondary repository shall set up and manage a router.
2. Data exchange between the router and the primary and secondary repositories shall take place using the data format and data exchange modalities defined by the router.
3. Data exchange between the router and an ID issuer shall take place using the data format and data exchange modalities defined by the router.
4. Economic operators other than manufacturers and importers shall send the information recorded pursuant to Article 15 of Directive 2014/40/EU and in accordance with this Regulation to the router, which shall transfer it to the primary repository serving the manufacturer or importer whose tobacco products are concerned. A copy of those data shall be transferred instantaneously to the secondary repository system.
Costs of the repositories system
1. All costs related to the repositories system referred to in Article 24(1), including those that arise from its establishment, operation and maintenance, shall be borne by manufacturers and importers of tobacco products. Those costs shall be fair, reasonable, and proportionate:
(a)
to the services rendered; and
(b)
to the amount of unit level UIs requested over a given period of time.
2. The costs, as applicable, of establishing, operating and maintaining the secondary repository and the router shall be transmitted to manufacturers and importers of tobacco products through the costs charged to them by the providers of the primary repositories.
Deadline for the establishment of the repositories system
The repositories system shall be established and functional for testing purposes by 20 March 2019.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
