EN   EN 
 
 
 EUROPEAN  
COMMISSION   
Brussels, XXX   
[…](2020) XXX  draft  
ANNEX  
 
ANNEX  
to the  
Commission Delegated Regulation (EU) .../...  
amending Annex X to Regulation (EU) 2018/858 of the European Parliament and of the 
Council as regards the standardised access to vehicle on -board diagnostics information 
and repair and maintenance information, and the requirements and procedures for 
access  to vehicle security information   EN 1  EN ANNEX  
 
Annex X to Regulation (EU) 2018/858 is amended as follows:  
(1) point 2.1 is replaced by the following:  
‘2.1. A manufacturer shall put in place the necessary arrangements and procedures, 
in accordance with Article 61, to ensure that vehicle OBD information and 
vehicle repair and maintenance information is accessible through websites . 
Compliance with the obligation  for manufacturers  to provide  OBD 
information and vehicle repair and maintenance information  on their websites 
through  a standardised for mat shall be presumed by conforming to Part 1 
‘General information and use case definition’, Part 2 ‘Technical 
requirements’, Part 3 ‘Functional user interfa ce requirements’, Part 4 
‘Conformance test’ and Part 5 ‘Heavy duty specific provision’ of standard 
ISO 18541  – 2014  ‘Road vehicles — Standardized access to automotive 
repair and maintenance information (RMI)’ . Access to vehicle OBD 
information and vehicle repair and maintenance information shall be granted 
in a readily accessible and prompt manner .’; 
(2) point 2.5.2  is replaced by the following:  
‘2.5.2 .service handbooks, including service and maintenance records, and 
technical specificatio ns references regardin g fluids including on lubricants, 
brake fluids and  cooling liquids ;’; 
(3) in point 2.9, the first paragra ph is replaced by the following:  
‘For the purpose of vehicle diagnostics, repair and maintenance, monitoring 
and inspection, the direct vehicle data stream, including fault codes, and 
diagnostic functions, shall be made available through the serial data port on the 
standardised data link c onnector specified in paragraph 6.5.1.4 of Appendix 1 
of Annex 11 to Regulation No 83 of the Economic Commission for Europe  of 
the United Nations (UN/ECE)1 and paragraph 4.7.3 of Annex 9B to Regulation 
No 49 of the Economic Commission for Europe of the Uni ted Nations 
(UN/ECE)2’; 
(4) in point 6.1., the first paragraph is replaced by the following:  
‘Vehicle OBD information and vehicle repair and maintenance information 
available through websites shall comply with the Parts of standard ISO 18541 – 
2014  referred to  in point 2.1.’;  
(5) point 6.3  is amended as follows:  
(a) the first sentence is replaced by the following:   
                                                 
1 Regulation No 83 of the Economic Commission for Europe of the United Nations (UN/ECE) — Uniform 
provisions concerning the approval of vehicles with regard to the emission of pollutants according to 
engine fuel requirements (OJ L 42, 15.2.2012, p.  1). 
2 Regulation No 49 of the Economic Commission for Europe of the United Nations (UN/ECE) — Uniform 
provisions concerning the measures to be taken against the emission of gaseous an d particulate pollutants 
from compression -ignition engines for use in vehicles, and the emission of gaseous pollutants from 
positive -ignition engines fuelled with natural gas or liquefied petroleum gas for use in vehicles (OJ L 180, 
8.7.2011, p. 53).  EN 2  EN ‘The procedure for accreditation, approval and authorisation of independent 
operators to access vehicle security features as referred to in point 6.2 is set  out 
in Appendix 3. The  role and responsibilities of the bodies involved in the 
accreditation, approval and authorisation of independent operators are detailed 
in the functional requirements consisting examples and use cases laid down in 
Commission Notice ….’; 
(b) the following paragraph is added:  
‘For the purposes of that procedure, o perators shall not be considered to pursue  
a legitimate business activity where they perform, assist, offer or advertise 
repair or maintenance operations that would negatively imp act the emissions 
performance of the vehicle . This shall include:  
(c) deactivating or removing pollution control devices or emission control systems, 
or degrading their performance or concealing their malfunction;  
(d) installing defeat devices3, or defeat strategi es4; 
(e) deactivating, removing or tampering5 with devices for the monitoring of the 
consumption of fuel or electric energy, or tampering  with odometer readings;  
(f) tampering with the engine control unit, including the rated engine power.’;  
(6) the following Appendix  3 is added:  
‘Appendix 3  
Procedure for the accreditation, approval and authorisation of independent operators to 
access vehicle security features6 
1. Scope  
This Appendix contains the requirements  for the purposes of accreditation, approval and 
author isation  of independent operators  requiring access to security -related vehicle repair 
and maintenance information  (RMI)  services.  
It specifies in detail the process and the bodies required to approve and authoris e 
independent operators  to be granted access to security -related vehicle repair and 
maintenance information  for light passenger and commercial v ehicles and heavy duty 
vehicles.  
2. Definitions, symbols and abbreviated terms  
2.1. Definitions  
For the purposes of this Appendix, the following definitions shall apply:  
2.1.1.  'Accreditation ' 
‘accreditation’ shall mean accreditation a s defined in Article 2 , point  10 of Regulation 
(EC) No 765/2008  
2.1.2.  'IO employee'  
                                                 
3 As defined in Article 3(10) of Regulation (EC) No 715/2007.  
4 As defined in Article 3(8) of Regulation (EC) No 595/2009.  
5 As defined in Article 3(16) of Regulation (EC) No 595/2009.  
6 The requirements set out in this Appendix are based on those laid down in the ‘Scheme for accreditation, 
approval and authorization to Access Security -related Repair and Maintenance Information (RMI)’ 
validated on 19 May 2016 by the European co -operation for Accreditation ( https://www .vehiclesermi.eu/ ) EN 3  EN ‘IO employee’ shall mean t he employee of an approved IO who , upon authorisation 
from his or her CAB , will have  access security -related RMI  
2.1.3.  'Security -related repair and maintenance information' or 'security -related RMI'  
'security -related repair and maintenance information' or 'security -related RMI ’ shall 
mean t he information, software, fun ctions and services required to repair and maintain 
the features  that are  included in a vehicle  by the manufacturer to prevent the vehicle 
from being stolen or driven away and to enable the vehicle to be tracked and recovered.  
2.1.4.  'Approval inspection certific ate'  
'approval inspection certificate' shall mean the certificate i ssued by the CAB to IOs 
complying with  the approval criteria set out in this Appendix and which confirms  that 
those IOs are approved and that IO employees can request the authorisation to access 
security -related RMI.  
2.1.5.  'Authorisation inspection certificate'  
'authorisation inspection certificate' shall mean the certificate i ssued by the CAB to IO 
employees complying with  the authorisation criteria set out in this Appendix and which 
confirms  that those employees are authorised to access security -related RMI on the 
website of a vehicle manufacturer.  
2.1.6.  'Trust centre ' or 'TC'  
'trust centre' or 'TC'  shall mean the b ody designated by SERMI and approved by the 
Commission  and that is  responsible for : 
(a) managing the digital certificates and authorisation status of the IO employees and 
for providing to the CAB the necessary secure hardware tokens  and digital 
certificates for authorised IO employees ; 
(b) providing a vehicle manufacturer with information  regarding the authorisation 
status of an IO employee.  
2.1.7.  'Secure hardware token'  
'secure hardware token ’ shall mean  a card or USB device protected against unauthorised 
access or copy  by a PIN . 
2.1.8.  'Digital certificate'  
'digital certificate ’ shall mean  a digital certificate  which requires  a digital signature of 
the issuing trust centre  to bind a public key to the identity of the IO employee in 
accordance with the standard ISO 9594.  
2.1.9.  'Authorisation database'  
'authorisation database ’ shall mean a  database held by t he trust centre  and which 
contain s the authorisation details of the anonymised authorised IO employees and the 
registration of  approved IOs.  
2.1.10.  'Certification database ' 
‘certification database'  shall mean a d atabase held by the trust centre  to manage the 
digital certificate validity and the identifiers of authori sed IO employees.  
2.1.11.  'European co -operation for Accreditation ' or 'EA' 
'European co -operation for Accreditation' or 'EA'  shall mean the b ody recognised by the 
Commission in accordance with Article 14 of  Regulation (EC) No 765/2008 and which EN 4  EN is responsible for  the development, maintenance and implementation of accreditation in 
the Union .  
2.1.12.  'Forum for Access to Security -Related Vehicle RMI ' or 'SERMI ' 
The 'Forum for Access to Security -Related Vehicle RMI' or 'SERMI'  means the  entity 
that is  in charge of coordinating and advising the Commission on the implementation of 
the procedures of "accre ditation, approval and authoris ation for the purpose of 
accessing" security -related RMI  .  
2.1.13.  'Relevant authorities ’ 
‘relevant authorities ’ shall mean those  public authorities that have a legal mandate to act 
in the area of vehicle security crime protection, investigation and prosecution.  
3. Accreditation of CABs, a pproval of IOs and authorisation  of IO  employees  
Only CABs that are accredited by the national accreditation body (‘NAB’) , as defined in 
Article 2, point  11 of Regulation (EC) No 765/2008 , of the Member State in which they 
are established shall  issue approval inspection certificates certifying that an IO has been 
approved  and authorisation inspection certificates certifying that an  IO employee  is to 
access security -related RMI.   
The approval of the IO and the authorisation of the IO employee shall be  granted for a 
period of 60 months  starting from the dat e of issuance of the relevant inspection 
certificates .   
IOs wishing to receive security -related RMI shall  obtain an approval  inspection 
certificate from a CAB accredited by the NAB of the Member State where the IO is 
established .  
IO employees who are to handle securit y-related RMI shall  obtain an authorisation 
inspection certificate from a CAB accredited by the NAB of the Member Stat e where 
the IO employee resides.  
CABs shall inform TCs of any approval inspection certificates or authorisation 
inspection c ertificates issued, upon which TCs shall create an author isation  record and 
issue a secure hardware token and a digital certificate containing details that allow IO 
employee s to be uniquely identifiable to the vehicle manufacturer  RMI website. CAB s 
shall provide individual IO employee s with a  secure hardware token and the digital 
certificate.  
Vehicle manufactures may demand a fee for the registration of IO employees on those 
vehicle manufacturers’ RMI websites and for access to security -related RMI. Such fee 
shall be proportionate to the cost for such registration and provision of access. The fees 
due shall be specified on the vehicle manufacturer s’ RMI websites . All digital data 
transfers between  IOs, TC s and CAB s shall be carried out via business  to business 
(B2B) transactions using secure protocols  and in a timely manner . 
 EN 5  EN  
Figure 1: The bodies involved in the accreditation of CABs, approval of IOs and 
authorisation of IO employees  and their relationship  
 
A declaration that certif ies that the IO pursues  a legitimate business activity  as referred to in  
point 6.3. of this Annex  shall be signed by the IO requesting to be authorised by the CAB . An 
IO shall only be approved after an  inspection by the CAB  that sha ll verify that this declaration 
has been signed and that shall assess  whether the IO  and its individual employees comply 
with the requirements laid down  in this Appendix.   
Individual IO employee s shall only be authorised after an  inspection by a CAB .CAB s shall 
check the documents submitted  and shall verif y whether the IO employee  concerned  made a 
previous request for authorisation  that ha s been rejected by the CAB concerned  or any other 
CAB at Union level.  
CAB s shall  send all data to the TC that are necessa ry for the TC to produce the digital 
certificate  and the secure hardware token , which the CAB shall send to  the IO employee s..  
IO employee s that have been authorised  shall receive  from their CABs  the PIN associated 
with the digital certificate .  
EN 6  EN  
Figure 2: IO approval and IO employee authori sation process  
 
3.1. Overview of the access to security -related RMI  
Vehicle manufacturer s shall provide a ccess to security -related RMI  through their 
RMI website , provided that the IO employee s are authori sed and are able to produce 
the authorisation inspection certificate , and that t he IO on whose behalf the IO 
employee s are working has an approval inspection certificate.   
Manufacturers may offer access to an on -line ordering facility for security -related 
parts using a speciali sed application linked to the RMI website to authorised  IO 
employee s that work for approved IOs .  
Upon receipt of a request  for access to an RMI website, the vehicle manufacturer s’ 
website s shall  require identification through  the IO employee unique identifier and 
request authentication. Authentication of IO employee s shall be carried out 
exclusively using digital certificate s. Upon receipt of a digital certificate, vehicle 
manufacturer  RMI website s shall verify the IO employee  unique identifier and the 
current status of the digital certificate and author isation , by communicating with the 
trust centre  identified in the digital certificate.  
All digital data transfers between IO s, vehicle manufacturer s, TCs and CAB s shall  be 
carried out via business to business (B2B) transactions , using secure protocols  and in 
a timely manner . Once the IO employee unique identifier and author isation  status of 
the IO employee ha ve been verified, access to the required security -related RMI shall  
be provided by the vehicle manufacturer through its website.  
EN 7  EN  
Figure 3: Access to security -related RMI  
4. Detailed rules concerning access to security -related RMI  
4.1. The role of SERMI  
4.1.1.  Responsibilities and obligations   
(1) SERMI shall  advise the Commission  on requests for chang es to the 
accreditation process. SERMI shall monitor the implementation of the 
accreditation  process across the Member States and inform the Commission 
accordingly . 
(2) SERMI shall consult the Commission on the creat ion of  the TC selection 
criteria.  
(3) SERMI shall,  advise the Commission on the introduction of technical 
implementation guidelines for interaction between the entities involved  in 
the process . 
(4) SERMI  shall  follow the EA's rules on scheme owners hip. 
(5) The members of the SERMI shall be represent ed by  the stakeholders 
engaged in the process of accreditation, approval and authorisation for the 
purpose of accessing  security -related RMI.  
4.1.2.  Trust centre  selection  
The TC shall  be selected by SERMI  and be notified to the Commission for approval.  
EN 8  EN Selected TC shall comply with standard ETSI TS 319 411 -3, fulfill the requirements 
on electronic signatures laid down in Regulation (EU) No 910/2014  of the Europea n 
Parliament and of the Council7 and the requirements laid down  in point 6.6 of this 
Appendix . 
In addition , the TC shall:  
– have the  technical and manage rial competence,  and the  financial viability and 
experience  relevant to the accreditation process  
– have key personnel  that has the skills, experie nce and availability necess ary for 
the accreditation process ; 
– be able to operate across Member States ; 
– have in place a quality assurance process at operational level.  
4.2. The role of NAB s 
The NAB s hall be  responsible for the accreditation of CAB s for the purposes of 
approving IO s and authori sing IO employees for access to security -related RMI.  
4.2.1.  Responsibilities and requirements  
The responsibilities and requirements of the NAB are set out in Articles 8  to 12 of  
Regulation (EC) No 765/2008 . 
4.2.2.  Criteria for CAB accreditation  
CAB s shall be accredited as type A inspection bod ies in accordance with ISO/IEC 
17020:2012. CAB s shall  comply with the requirements concerning the highest 
level of independence . 
Additionally, the NAB shall assess  CABs ’ capability to comply with the 
requirement s laid down  in point 4.3.1 and the functional requirements described in 
point 4.3.2 during the accreditation process.  
The personnel in charge of IO inspections shall have a level of knowledge in the 
automotive vehicle repair and maintenance business and of  the automotive 
aftermarket specifics that is appropriate for the tasks they are performing.  
4.3. The role of CABs 
The CAB shall be  responsible for the inspection of IOs and their respective IO employees and 
for issuing approval and authorisation inspection cer tificates in accordance with this 
Appendix, and for revoking such certificates . 
4.3.1.  Responsibilities and requirements  
(a) CAB s shall keep the data submitted for the approval of an IO;  
(b) CAB s shall establish a secure communication channel with the TC and provide 
the inspection results to the TC in order to issue the secure hardware token with 
a digital certificate;  
(c) CAB s shall notify IO employees 6 months before their authorisation expires;  
                                                 
7 Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on 
electronic identification and trust services for electronic transactions in the internal market and repealing 
Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73).  EN 9  EN (d) CAB s shall maintain a database containing data submitted for the authorisation 
of IO employees;  
(e) CAB s that refuse  to approve an IO or authoris e of an IO employee shall 
communicate the inspection results concerning that IO or that employee to the 
TC; 
(f) CAB s shall  only collect and use data required for the approval  or authorisation 
process;  
(g) CABs shall keep all d ata relating to IO and IO employees confidential and 
shall ensure that only unauthorised employees have access to such data ; 
(h) CAB s shall provide once a year statistics  on the number of approval and 
authorisations issued and also on the number of refusals  to SERMI and the 
Commission;  
(i) CAB s shall retain secure records of approval and authorisation inspections for 
a period of 5 years;  
(j) CAB s shall inform all other C ABs in the Member State in which it is 
established about negative inspection results of an IO;  
(k) IOs and IO employees that have received a negative inspection result may 
provide  the CAB with additional information correcting minor deficiencies  
within 15 work ing days  from receiving the negative inspection result . CAB s 
shall  accordingly determine whether the inspection result is to be changed;  
(l) CAB s shall notify IOs 6 months before their approval expires.  
(m) CAB s shall make random und unannounced on -site inspections of IOs within 
the 60 months approval validity period , and subject each  approved IO to at 
least one random, on -site inspection over the 60 months approval validity 
period.  
(n) On the basis of a complaint a gains t an approved IO or an authorised IO 
employee , CABs shall check that the concerned IO or IO employee  are in 
compliance with the criteria against which they were respectively approved or 
authorised. The CAB shall determine during its investigation whet her an on on -
site inspection is required.  
(o) For the purposes of on -site inspections, CABs may request the assistance of 
market surveillance authorities from  the Member State they are established.  
(p) CABs shall revoke IO approval s and IO em ployee authorisations where they 
no longer comply with the criteria against which they were respectively 
approved or authorised. CABs shall accordingly request the TC to suspend and 
repeal digital certificate  of the concerned IO employees.  
 
4.3.2.  Renewal of the approval  
CAB s shall, upon request by an IO or 6 months prior to the expiry of validity of the 
approval, make an on -site inspection, and in case of a positive inspection result, renew 
the approval.  EN 10  EN CAB s shall issue a new approval inspection certificate for IO that fulfils the approval 
criteria . 
CAB s shall assess applications for renew als of  authorisation s and issue an authorisation 
inspection certificate to IO employees fulfilling the authorisation criteria . 
4.3.3.  Criteria for IO approval  by the CAB  
Before approvi ng an IO and during an y on-site inspection during the approval validity 
period , CAB s shall check the following : 
(6) (a) documented ownership o f IO, name of managing director . 
(7) (b) the list provided by the IO of employees to be authori sed; 
(8) (c) information about the responsibility and the function of employees  referred to 
in point (a);  
(9) (d) whether  the IO has a liability insurance  with a m inimum amount of coverage  of 
1 million Euro for bodily injury and 0 ,5 million Euro for property damage ; 
(10) (e) whether  the approval  of the IO has been revoked  for reasons of misuse.  
(11) (f) whether the IO has provided p roof of activity in the automotive area ; 
(12) (g) whether the declaration certifying that the IO pursues a legitimate business 
activity as referred to in point 6.3   has been  signed by the IO and during an on -sire 
inspection whether the IO effectively conducts a  legitimate business activity ; 
(13) (h) whether the IO or the IO employees have a  clean criminal record ; 
(14) (i) whether there is d eclaration signed by the IO legal representative t hat 
compliance with the procedural requirements laid down  in point 4.3.4 is ensured 
for all operations related to vehicle security ; 
 
4.3.4.  Criteria for IO employee author isation  by the CAB  
Before authorising an employee as an IO employee, and during an y on-site inspection 
during the approval validity period , CAB s shall  verif y the following : : 
(a) that the employee concerned did not have a previous authorisation which has been 
revoked because  of misuse  of that authorisation ; 
(b) that the employee has a clean criminal record;  
(c) that there is an employment agreement between the employee concerned and an 
approved IO; 
(d) that the employee concerned has a valid country specific identity card or an 
equivalent  document . 
4.4. Role of the  IOs 
4.4.1.  Responsibilities and requirements  
(15) (a) IOs shall request an inspection from the ir CAB to obtain approval;  EN 11  EN (16) (b) IOs shall inform the ir CAB about changes in their contact details;  
(17) (c) IOs shall inform the ir CAB when their business is dissolved;  
(18) (d) IOs shall record  every  security related RMI transaction and operation;  
(19) (e) IOs shall inform the ir CAB of any termination of employment of any of their 
authorised employee s; 
(20) (f) IOs shall report to the relevant authorities any offence  or misconduct that has 
been committed by their authori sed employees and that is concerns security 
related RMI ; 
(21) (g) IOs shall ensure that their authorised employees only use their own 
authorisation inspection certificates;  
(22) (h) IOs shall ensure  that all fees relating to the ir IO employee's authorisation have 
been paid;  
(23) (i) IOs shall ensure that their IO  employees are trained for repair activities 
concerning automotive maintenance, reprogramming  and security and safety 
functions;  
(24) (j) IO shall request their CAB for an on -site inspection  in the six months prior to 
the expiration of their  approval  inspection certificate . 
4.5. Role of  IO employee s 
. 
4.5.1.  Responsibilities and requirements  
(25) (a) IO employee s shall request the ir CAB for authoris ation  
(26) (b) IO employee s shall register themselves on the vehicle manufacturer’s RMI 
system;  
(27) (c) IO employee s shall access secure related RMI in accordance with ISO standard 
18541 – 2014 ; 
(28) (d) IO employee s shall ensure that all records of security related RMI downloaded 
from the vehicle manufacturer RMI system shall  not be stored any longer  than 
necessary for performing  the operation for which the information is needed;  
(29) (e) where applicable, IO employee s shall notify  their IO employer  that their digital 
certificate is no longer required;  
(30)  (f) IO employee shall not share with any third party the secure software token , the 
digital certificate or  the PIN;; 
(31) (g) IO employee s shall be responsible for using the personal secure software token 
and PIN  correctly ; 
(32) (h) IO employee s shall inform the ir IO and the ir TC about any loss or misuse of 
their secure hardware token within 24 hours of such loss or misuse;  
(33) (i) IO employee s shall report to the relevant authorities any request or act from 
other IO employees relating to secure RMI that does not constitute a legitimate 
business activity as referred to in point 6.3. of this Annex.  
4.6. Role  of the trust centre  EN 12  EN TCs shall create and send the digital  certificates to the IO s via the respective CAB s to the IO s 
and the IO employees. TC s shall maintain a database of issued inspection authorisation 
certificates . TCs shall provide vehicle manufactures access to an interface to verify the status 
of the  digital  certificates and the inspection authorisation certificates .  
TCs shall keep the information regarding IO  employees in the authorisation database for an 
additiona l period of maximum 60 months.  That period shall not be longer than the remaining 
validity period of the approval granted to the IO where the IO employee is working.  
 
4.6.1.  Responsibilities and requirements  
(a)  TCs can suspend and repeal digital certificates  upon request from the CAB ; 
 
(b)  TCs shall provide the software to  use the digital certificates  to the IO and IO 
employees ; 
(c) TCs shall operate 24 hours a day, 7 days a week;  
4.7. Role of vehicle manufacturer s 
Vehicle manufacturer s shall  provide to all approved IOs  and authorised IO employees access 
to security -related repair and maintenance information. Vehicle  manufacturer s shall  
communicate with TCs to verify the author isation  and authentication status of IO employee s 
seeking access  to such information . 
4.7.1.  Responsibilities and requirements   
(34) (a) vehicle manufacturers shall ensure that their websites are adapted to support 
the access of IOs to security -related RMI;  
(35) (b) vehicle manufacturers shall ensure that they download the latest softw are 
updates made available on the SERMI website.  
(36)  
4.7.2.  Procedural requirements for vehicle manufacturer s 
Vehicle manufactures shall not grant access  to secure related RMI , unless all of the 
following procedural requirements  have been complied with : 
(37) (a) procedu ral requirements for stolen vehicles.  
Vehicle manufacturer s shall  keep a record of all vehicles of its brand reported as stolen 
by the authorities.  
Vehicle manufactures shall put in place a  process that  provide s clear traceability and 
accountability  and enables the relevant authorities to trace the data supplied by the 
vehicle manufacturer to the IO employee who was granted access to the information 
related to the stolen vehicle.  
(b) Procedural requirements for storing information  
Vehicle manufacturer s shall store  the following information for each access granted to 
security -related repair and maintenance information : 
(38) (a) the Vehicle Identification Number (VIN)  of the vehicle for which the 
information was requested ; 
(39) (b) the date the request was made;  EN 13  EN (40) (c) the vehicle registration number  of the vehicle for which the information was 
requested , where available ; 
(41) (d) type variant  of the vehicle for which the information was requested and the  
version of th at vehicle , where available . 
Vehicle manufacturer s shall store th ose data for 5 years.