General characteristics of the repositories system
Article 25
1. The repositories system shall satisfy the following conditions: (a) it shall allow for functional integration of the repositories system into the traceability system, as well as uninterrupted electronic data exchange between the repositories system and other relevant components of the traceability system; (b) it shall allow for electronic identification and authentication of tobacco products, at unit packet and aggregation level, in accordance with the requirements set out in this Regulation; (c) it shall allow for automatic deactivation of unique identifiers in accordance with the rules set out in Article 5; (d) it shall ensure electronic receipt and storing of information recorded and sent to the repositories system by economic operators and ID issuers, in accordance with the requirements of this Regulation; (e) it shall ensure storage of data for a minimum period of five years as of the moment the data are uploaded into the repositories system; (f) it shall allow for automatic status messaging to economic operators, and to Member States and the Commission as requested, such as in the event of success, error or changes related to reporting activities, in accordance with the requirements of this Regulation; (g) it shall allow for automatic validation of messages received from economic operators, including refusal of incorrect or incomplete messages, in particular reporting activities related to non-registered or duplicated unique identifiers, whereby the repositories system shall store the information concerning any refused message; (h) it shall ensure messaging between all of its components which shall take place instantaneously, in accordance with the requirements of this Regulation, in particular the overall response time of the repositories system in sending acknowledgment messages, not considering the speed of the internet connection of the end user, which shall be no more than 60 seconds; (i) it shall ensure continuous availability of all components and services with a monthly uptime of at least 99,5 % and sufficient back-up mechanisms in place; (j) it shall be guarded by security procedures and systems ensuring that access to the repositories and download of the data stored therein is only granted to persons authorised according to this Regulation; (k) it shall be accessible by the competent authorities of Member States and by the Commission. National administrators designated by the Member States and Commission services shall be granted access rights enabling them to create, manage, and withdraw user access rights for repositories, and related operations stipulated in this Chapter, via a graphical user management interface. The graphical user management interface shall be compatible with Regulation (EU) No 910/2014, in particular the relevant reusable solutions provided as building blocks under the telecommunication part of the Connecting Europe Facility. National administrators designated by the Member States shall be able to grant subsequent access rights to other users under their responsibility; (l) it shall enable Member States and the Commission to carry out downloads of full and selected sets of data stored in a repository; (m) it shall maintain a complete record (‘audit trail’) of all operations concerning the stored data of the users performing those operations and of the nature of these operations, including the history of users access. The audit trail shall be created when the data is uploaded for the first time and, notwithstanding any additional national requirements, be maintained until at least five years after. 2. Data stored in the repositories system shall be used only for the purposes referred to in Directive 2014/40/EU and this Regulation.