Commission Implementing Regulation (EU) 2018/574 of 15 December 2017 on technical standards for the establishment and operation of a traceability system for tobacco products (Text with EEA relevance. )

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Directive 2014/40/EU of the European Parliament and of the Council of 3 April 2014 on the approximation of the laws, regulations and administrative provisions of the Member States concerning the manufacture, presentation and sale of tobacco and related products and repealing Directive 2001/37/EC⁽¹⁾, and in particular Article 15(11) thereof,

Whereas:

In order to address the issue of illicit trade in tobacco products, Directive 2014/40/EU provides that all unit packets of tobacco products are to be marked with a unique identifier in order for their movements to be recorded. This will enable such products to be tracked and traced throughout the Union. Technical specifications regarding the system's establishment and operation, as well as its compatibility throughout the Union, should be laid down.
Rules concerning the marking of packages with a unique identifier, the recording and transmission of data, the processing, storing and accessing of data and the compatibility of components of the traceability system should be set.
Legislative action at Union level is also necessary in order to implement Article 8 of the Protocol to Eliminate Illicit Trade in Tobacco Products to the World Health Organisation's Framework Convention on Tobacco Control⁽²⁾ (‘WHO FCTC Protocol’), which has been ratified by the European Union⁽³⁾ and provides for a global tracking and tracing regime for tobacco products, to be established by the Parties to the WHO FCTC Protocol within five years of its entry into force.
In order to combat multiple existing types of fraudulent activities that result in illicit products being made available to consumers, including practices that entail the false declaration of exports, the traceability system provided for under this Regulation is to apply, in accordance with Article 15 of Directive 2014/40/EU, to all tobacco products manufactured in the Union, as well as to those manufactured outside the Union insofar as they are destined for or placed on the Union market.
In order to provide for the independence of the traceability system and guarantee that it is controlled by the Member States, as provided for under Article 8 of the WHO FCTC Protocol, a proper assignment of roles in relation to the marking of packages with a unique identifier is essential. The key task of generation of the unique identifiers at unit packet level should be attributed to an independent third party appointed by each Member State (‘ID issuer’).To avoid the risk that two or more ID issuers, independently of each other, generate the same unique identifier, each ID issuer should be identified by a unique identification code, which should also form part of the unique identifiers issued by them.
In order to guarantee the uniqueness of the identifier, a serial number generated by the ID issuer should form part of each unique identifier that has a negligible probability of being guessed by falsifiers.
When requesting unit packet unique identifiers from an ID issuer, manufacturers and importers should be required to provide all information necessary for the issuer to be able to generate that identifier, in accordance with Article 15(2), points (a) to (h) of Directive 2014/40/EU, with the exception of date and time of manufacture, which may not be possible to determine in advance and which should be added by economic operators at the moment of production.
The length of the unit level unique identifier may impact the speed at which it can be applied to unit packets by tobacco product manufacturers or importers. In order to avoid an excessive impact on this process whilst ensuring sufficient space for all information required at unit packet level, the maximum permitted number of alphanumeric characters for the unit level unique identifier should be laid down.
In order to ensure that unit level unique identifiers are capable of meeting the requirements relating to the maximum permitted number of alphanumeric characters, information required under Article 15(2) points (a) to (h) of Directive 2014/40/EU should be translated into code.
For the purpose of enabling the competent authorities of the Member States to decode the unique identifiers without accessing the information stored in the repositories system, flat-files should be established and maintained by the ID issuers. Such flat-files should enable all information codified in the unique identifier codes to be identified. The size of such flat-files should be defined, in order to ensure that they can be downloaded to the devices used by Member States when reading the unique identifiers in offline mode (offline flat-files).
Directive 2014/40/EU provides that the recording obligations established pursuant to Article 15 may be complied with by the marking and recording of aggregated packaging, such as cartons, mastercases or pallets, provided that the tracking and tracing of all unit packets remains possible. Where economic operators opt to make use of that possibility, they should be required to ensure that such packaging is marked with an aggregated level identifier which is also unique and therefore capable of unequivocally identifying any lower aggregated levels and ultimately the unit packets that it contains.
In order to ensure that all movements of the unit packets can be recorded and transmitted, manufacturers and importers should verify the unique identifiers so as to ensure their correct application and readability. To control this critical process for the unit level unique identifiers, anti-tampering devices, which are to be supplied by an independent third party, should be installed on the devices used for verification purposes. In laying down rules on the installation of such devices, it is appropriate to take into account differences between undertakings, particularly as regards their size, production output and nature of the production process, so as to ensure that compliance with this requirement does not entail an excessive burden, particularly, on smaller operators, including small and medium-sized enterprises (SMEs). As anti-tampering devices are of particular relevance to the automated production of tobacco products, for the purpose of ensuring that the integrity of unit level unique identifiers is adequately protected, it is appropriate to limit the obligation to install such devices to operators other than those that use fully manual production processes.
In order to minimise the impact of the traceability system on production and distribution schemes, economic operators should be permitted to order batches of the unique identifiers in advance. However, to avoid overstocking of the unique identifiers by economic operators and to control the size of individual orders, a time limit for the application of unique identifiers issued at both unit packet and aggregated levels should be set. These measures should also alleviate potential excessive impacts on the generation and issuing activities performed by the ID issuers.
In order to ensure the proper functioning of the traceability system, economic operators and operators of first retail outlets should apply in advance to the relevant ID issuers for an economic operator identifier code and for a facility identifier code for each facility. The assignment of economic operator identifier codes and facility identifier codes permits the efficient identification of all purchasers and of the actual shipment route from manufacturing to the first retail outlet as provided for in Article 15(2) points (i) and (j) of Directive 2014/40/EU.
Manufacturers or importers should in addition apply for an identifier code for machines used to manufacture tobacco products. The obligation to apply for machine identifier codes permits the efficient identification of the machine used to manufacture the tobacco products in accordance with Article 15(2) point (c) of Directive 2014/40/EU.
In order to ensure that the information contained in the unique identifier is capable of being recorded and transmitted by all relevant economic operators, as well as to guarantee the compatibility of the unique identifier with external components such as scanning devices, the types of permitted data carriers should be specified.
In order for the traceability system to be able to achieve its objective, it is necessary for it to be capable of enabling easy transmission of all relevant data, providing secure storage of data and ensuring full access to this data for the Commission, the competent authorities of the Member States and the external auditor. The storage architecture should further allow manufacturers and importers to select independent third party data storage providers with which to conclude data storage contracts for the purpose of hosting data related exclusively to their tobacco products (‘primary repositories’), as provided for by Article 15(8) of Directive 2014/40/EU, whilst ensuring authorities are provided with full access to all stored data for the purpose of carrying out their monitoring and enforcement activities. The effectiveness of such monitoring and enforcement activities requires the presence of a single second-level repository system (‘secondary repository’), containing a copy of all the data stored in the primary repositories and providing authorities with a global overview of the functioning of the traceability system. A routing system, operated by the provider of the secondary repository, should be established in order to provide economic operators other than manufacturers and importers with a single entry point to submit the data recorded by them to the traceability system and thereby ease the data transmission. At the same time, the routing service should ensure that data are transmitted to the correct primary repository.
In order to guarantee full access for relevant authorities and to contribute to the efficient functioning of the traceability system, the provider of the secondary repository should develop user interfaces enabling the stored data to be viewed and queried. In accessing the repositories system the relevant authorities should be able to rely on the eIDAS⁽⁴⁾ based reusable solutions provided as building blocks under the telecommunication part of the Connecting Europe Facility. In addition, to facilitate effective surveillance and enforcement, the user interface should allow for the possibility to define individual automatic alerts based on specific reporting events.
To ensure interoperability of the components of the repositories system, technical specifications, based on non-proprietary open standards, should be established for the exchange of data between the primary repositories, the secondary repository and the routing system.
In order to ensure that the required information is recorded and transmitted in a timely and uniform manner by all economic operators, the precise list of supply chain and transactional events that are required to be recorded under Article 15(2), points (i), (j) and (k) of Directive 2014/40/EU, as well as the content of the information messages to be transmitted, should be laid down.
Given that the aim of a traceability system is to provide Member States and the Commission with an effective tool to fight illicit trade of tobacco products, timely availability of supply chain and transactional event data is necessary for investigation and enforcement purposes. The maximum time that may elapse between the occurrence of a relevant supply chain or transactional event and the transmission of the related information to the relevant data storage repository should therefore be established. In laying down such time-limits, it is appropriate to take into account differences between undertakings, particularly as regards their size and production output, so as to ensure that compliance with reporting obligations does not entail an excessive burden, particularly on smaller operators, including small and medium-sized enterprises (SMEs).
For investigation and enforcement purposes, it is necessary that competent authorities of Member States and the Commission have access to a record of all economic operators and operators of first retail outlets involved in the trade of tobacco products, as well as the facilities and machines that are used by them to manufacture, store and process their products. Therefore, each ID issuer should establish and maintain a registry that contains the identifier codes for economic operators, operators of first retail outlets, machines and facilities referred to above. An up-to-date copy of these registries, along with the corresponding information, should be transferred electronically via the router to the secondary repository and compiled into an EU-wide register.
Given the requirement for the traceability system to be independent of manufacturers and importers of tobacco products and to be under the control of the Member States, as provided for under Article 8 of the WHO FCTC Protocol, common criteria for the assessment of independence of all third parties involved in the traceability system (ID issuers, providers of repository services and anti-tampering devices) should be laid down. In order to ensure the continuing respect of the requirement for independence that is critical for ensuring and maintaining the integrity of the traceability system, the procedures governing the appointment of the ID issuers and other independent providers and the monitoring of their compliance with the independence criteria set out in this Regulation should undergo periodic review by the Commission. Conclusions of the review should be published by the Commission and form part of the report on the application of Directive 2014/40/EU provided for under Article 28 of that Directive.
The protection of personal data processed in the context of a traceability system should be ensured in accordance with Directive 95/46/EC of the European Parliament and of the Council⁽⁵⁾.
Recourse to international standards should be possible for the purposes of demonstrating fulfilment of certain technical requirements laid down in this Regulation. Where it is not possible to prove compliance with international standards, it should be the responsibility of the persons to whom the obligations are imposed to prove, by verifiable means, that they comply with those requirements.
The measures provided for in this Regulation are in accordance with the opinion of the Committee referred to in Article 25 of Directive 2014/40/EU,

HAS ADOPTED THIS REGULATION:

CHAPTER I SUBJECT MATTER AND DEFINITIONS

Article 1 Subject matter

This Regulation lays down the technical standards for the establishment and operation of the traceability system provided for in Article 15 of Directive 2014/40/EU.

Article 2 Definitions

For the purposes of this Regulation, in addition to the definitions laid down in Article 2 of Directive 2014/40/EU, the following definitions shall apply:

‘unique identifier’ means the alphanumeric code enabling the identification of a unit pack or an aggregated packaging of tobacco products;
‘economic operator’ means any natural or legal person who is involved in the trade of tobacco products, including for export, from the manufacturer to the last economic operator before the first retail outlet;
‘first retail outlet’ means the facility where tobacco products are placed on the market for the first time, including vending machines used for the sale of tobacco products;
‘export’ means shipment from the Union to a third country;
‘aggregated packaging’ means any packaging containing more than one unit packet of tobacco products;
‘facility’ means any location, building or vending machine where tobacco products are manufactured, stored or placed on the market;
‘anti-tampering device’ means the device allowing for the recording of the verification process following the application of each unit level unique identifier by means of a video or a log file, which once recorded cannot be further altered by an economic operator;
‘offline flat-files’ means the electronic files established and maintained by each ID issuer that contain data in a plain text format allowing for the extraction of information encoded in the unique identifiers (excluding the time stamp) used at the unit packet and aggregated packaging levels without accessing the repositories system;
‘registry’ means the record established and maintained by each ID issuer of all the identifier codes generated for economic operators, operators of first retail outlets, facilities and machines along with the corresponding information;
‘data carrier’ means a carrier representing data in a form readable with the aid of a device;
‘machine’ means the equipment used for the manufacture of tobacco products which is integral to the manufacturing process;
‘time stamp’ means the date and time of occurrence of a particular event recorded in UTC (Coordinated Universal Time) time in a prescribed format;
‘primary repository’ means a repository storing traceability data relating exclusively to the products of a given manufacturer or importer;
‘secondary repository’ means a repository containing a copy of all traceability data stored in the primary repositories;
‘router’ means a device established within the secondary repository that transfers data between different components of the repositories system;
‘repositories system’ means the system consisting of the primary repositories, the secondary repository and the router;
‘common data dictionary’ means a set of information describing the contents, format, and structure of a database and the relationship between its elements, used to control access to and manipulation of the databases common for all primary and secondary repositories;
‘working day’ means every day of work in the Member State for which the ID issuer is competent;
‘trans-loading’ means any transfer of tobacco products from one vehicle to another during which tobacco products do not enter and exit a facility;
‘vending van’ means a vehicle used for the delivery of tobacco products to multiple retail outlets in quantities that have not been predetermined in advance of the delivery.