### member states shall prohibit the placing on the market of tobacco for oral use , without prejudice to article 151 of the act of accession of austria , finland and sweden . ### member states shall prohibit the placing on the market of tobacco for oral use , without prejudice to article 151 of the act of accession of austria , finland and sweden . member states and regions of member states with a tradition of using oral tobacco shall have an opportunity to apply for a national or regional derogation from the prohibition on cultural or historical grounds .


### a unit packet of cigarettes shall have a cuboid shape . a unit packet of roll - your - own tobacco shall have the form of a pouch , i . e . a rectangular pocket with a flap that covers the opening . the flap of the pouch shall cover at least 70% of the front of the packet . a unit packet of cigarettes shall include at least 20 cigarettes . a unit packet of roll - your - own tobacco shall contain tobacco weighing at least 40 g . ### a unit packet of cigarettes shall have a cuboid shape and include at least 20 cigarettes . a unit packet of any other tobacco for smoking shall be packaged in a cuboid or cylindrical composite can or have the form of a pouch i . e . rectangular packet with a flap that covers the opening , and shall contain tobacco weighing at least 40g .


### member states shall prohibit the use of flavourings in the components of tobacco products such as filters , papers , packages , capsules or any technical features allowing modification of flavour or smoke intensity . filters and capsules shall not contain tobacco . ### member states shall prohibit the use of characterising flavourings in the components of tobacco products such as filters , papers , packages , capsules or any technical features allowing modification of flavour or smoke intensity . filters and capsules shall not contain tobacco .


### each unit packet and any outside packaging of nicotine - containing products below the thresholds set out in paragraph 1 shall carry the following health warning : this product contains nicotine and can damage your health . ### each unit packet and any outside packaging of nicotine - containing products which do not fall under the scope of directive 2001 / 83 / ec shall carry the following health warning : this product contains nicotine which is addictive and may damage your health .


### the following nicotine - containing products may only be placed on the market if they were authorised pursuant to directive 2001 / 83 / ec : ### nicotine - containing products that are presented as having properties for treating or preventing disease in human beings , other than through any message specified in paragraph 3 , may only be placed on the market if they were authorised pursuant to directive 2001 / 83 / ec


### member states shall prohibit the placing on the market of tobacco products with a characterising flavour . ### member states shall prohibit the placing on the market of tobacco products with a characterising flavour , without prejudice to article 151 of the act of accession of austria , finland and sweden .


### trust service providers who are established in the territory of the union shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide . having regard to state of the art , these measures shall ensure that the level of security is appropriate to the degree of risk . in particular , measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of adverse effects of any incidents . ### trust service providers who are established in the territory of the union shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide . having regard to the technological development , these measures shall fully respect the data protection rights and ensure a level of security appropriate to the degree of risk . in particular , measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of adverse effects of any significant incidents .


### the supervisory body shall have the power to issue binding instructions to qualified trust service providers to remedy any failure to fulfil the requirements indicated in the security audit report . ### the supervisory body shall have the power to issue binding instructions to qualified trust service providers to remedy any failure to fulfil the requirements set out in this regulation .


### use trustworthy systems and products which are protected against modification and guarantee the technical security and reliability of the process supported by them ; ### use systems and products which are protected against unauthorized modification and guarantee the technical security and reliability of the process supported by them ;


### monitoring trust service providers established in the territory of the designating member state to ensure that they fulfil the requirements laid down in article 15 ; ### trust service providers established in the territory of the designating member state fulfil the requirements laid down in this regulation ;


### the commission may , by means of implementing acts , establish reference numbers of standards for the security levels of electronic signature . compliance with the security level defined in a delegated act adopted pursuant to paragraph 6 shall be presumed when an electronic signature meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission shall , by means of implementing acts , establish definitions of the different security levels of electronic signatures referred to in paragraph 4 of this article and reference numbers of standards for the security levels of electronic signatures . compliance with a defined security level shall be presumed when an electronic signature meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### trust service providers shall process personal data according to directive 95 / 46 / ec . such processing shall be strictly limited to the minimum data needed to issue and maintain a certificate or to provide a trust service . ### trust service providers and supervisory bodies shall collect and process personal data according to directive 95 / 46 / ec . such collecting and processing shall be strictly limited to the minimum personal data needed to issue and maintain a certificate or to provide a trust service .


### with regard to paragraph 3 , qualified trust service providers issuing qualified certificates shall provide to any relying party information on the validity or revocation status of qualified certificates issued by them . this information shall be made available at any time at least on a certificate basis in an automated manner which is reliable , free of charge and efficient . ### with regard to paragraph 3 , qualified trust service providers issuing qualified certificates shall provide to any relying party information on the validity or revocation status of qualified certificates issued by them . this information shall be made available at any time at least on a certificate basis in an automated manner .


### a description of the notified electronic identification scheme ; ### a description of the notified electronic identification scheme and its security assurance level ;


### a qualified electronic signature shall have the equivalent legal effect of a handwritten signature . ### a qualified electronic signature shall satisfy the legal requirements of a signature in relation to data in electronic form in the same manner as a handwritten signature satisfies those requirements in relation to paper - based data ;


### information on by whom the registration of the unambiguous person identifiers is managed ; ### information on which entity the registration of the person identifiers is managed ;


### trust service providers shall , without undue delay and where feasible not later than 24 hours after having become aware of it , notify the competent supervisory body , the competent national body for information security and other relevant third parties such as data protection authorities of any breach of security or loss of integrity that has a significant impact on the trust service provided and on the personal data maintained therein . ### trust service providers shall , without undue delay after having become aware of it , notify the supervisory body and , where appropriate , other relevant bodies , such as the competent national body for information security or the data protection authority , of any breach of security or loss of integrity that has a significant impact on the trust service provided and on the personal data maintained therein .


### trust service providers shall guarantee the confidentiality and integrity of data related to a person to whom the trust service is provided . ### trust service providers shall ensure the confidentiality and integrity of data related to a person to whom the trust service is provided .


### member states shall not request for cross - border access to a service online offered by a public sector body an electronic signature at a higher security assurance level than qualified electronic signature . ### member states shall not request for cross - border access to a service online offered by a public sector body an electronic signature at a higher security level than qualified electronic signature .


### qualified certificates for electronic signature shall not be subject to any mandatory requirement exceeding the requirements laid down in annex i . ### qualified certificates for electronic signature for cross - border use shall not be subject to any mandatory requirement exceeding the requirements laid down in annex i .


### member states shall designate an appropriate body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . supervisory bodies shall be given all supervisory and investigatory powers that are necessary for the exercise of their tasks . ### member states shall designate a supervisory body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . the designated supervisory body , its addresses and the names of responsible persons shall be communicated to the commission . supervisory bodies shall be given adequate resources necessary for the exercise of their tasks .


### if an electronic signature with a security assurance level below qualified electronic signature is required , in particular by a member state for accessing a service online offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic signatures matching at least the same security assurance level shall be recognised and accepted . ### if an electronic signature with a security level below the defined level for a qualified electronic signature is required , in particular by a member state for accessing a service online offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic signatures matching at least the same security assurance level shall be recognised and accepted .


### this regulation applies to electronic identification provided by , on behalf or under the responsibility of member states and to trust service providers established in the union . ### this regulation applies to electronic identification provided by , on behalf of , under the responsibility or supervision of member states .


### trust service providers who are established in the territory of the union shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide . having regard to state of the art , these measures shall ensure that the level of security is appropriate to the degree of risk . in particular , measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of adverse effects of any incidents . ### trust service providers who are established in the territory of the union shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide . having regard to the technological development , these measures shall fully respect the data protection rights and ensure a level of security appropriate to the degree of risk . in particular , measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of adverse effects of any significant incidents .


### in order to implement paragraphs 1 and 2 , the competent supervisory body shall have the power to issue binding instructions to trust service providers . ### in order to ensure compliance with paragraphs 1 and 2 , the competent supervisory body shall have the power to issue binding instructions to trust service providers .


### without prejudice to paragraph 1 , the supervisory body may at any time audit the qualified trust service providers to confirm that they and the qualified trust services provided by them still meet the conditions set out in this regulation , either on its own initiative or in response to a request from the commission . the supervisory body shall inform the data protection authorities of the results of its audits , in case personal data protection rules appear to have been breached . ### without prejudice to paragraph 1 , in case of substantiated doubts , the supervisory body may at any time audit the qualified trust service providers to confirm that they and the qualified trust services provided by them still meet the conditions set out in this regulation , either on its own initiative or in response to a request from a supervisory body in another member state . the supervisory body shall inform the data protection authorities of the results of its audits , in case personal data protection rules appear to have been breached .


### ‘ creator of a seal’ means a legal person who creates an electronic seal ; ### ‘ creator of a seal’ means an entity or a legal person who creates an electronic seal ;


### without prejudice to article 16 , any trust service provider may submit the report of a security audit carried out by a recognised independent body to the supervisory body to confirm that appropriate security measures have been taken . ### without prejudice to article 16 , any trust service provider shall , without undue delay and not later than six months following the commencement of its activities , submit the report of a compliance audit carried out by a recognised independent body to the supervisory body to confirm that appropriate security measures have been taken .


### supervisory bodies shall cooperate with a view to exchange good practice and provide each other , within the shortest possible time , with relevant information and mutual assistance so that activities can be carried out in a consistent manner . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out inspections related to the security audits as referred to in articles 15 , 16 and 17 . ### supervisory bodies shall cooperate with a view to exchanging good practice . they shall , upon justified requests , provide each other assistance so that activities can be carried out in a consistent manner . requests for assistance may cover , in particular , information requests and supervisory measures , such as requests to carry out inspections related to the compliance audits as referred to in articles 15 , 16 and 17 .


### member states shall notify to the commission , without undue delay , information on the body responsible for establishing , maintaining and publishing national trusted lists , and details of where such lists are published , the certificate used to sign or seal the trusted lists and any changes thereto . ### member states shall notify to the commission , without undue delay , information on the body responsible for establishing , maintaining and publishing national trusted lists , and details of where such lists are published , the certificate that is used to validate the signature or seal applied to the trusted lists and any changes thereto .


### use trustworthy systems to store data provided to them , in a verifiable form so that : ### use systems to store data provided to them , in a verifiable form so that :


### the supervisory body shall provide to enisa and to the commission once a year with a summary of breach notifications received from trust service providers . ### the supervisory body of each member state shall provide enisa once a year with a summary of breach notifications received from trust service providers .


### use trustworthy systems and products which are protected against modification and guarantee the technical security and reliability of the process supported by them ; ### use systems and products which are protected against unauthorized modification and guarantee the technical security and reliability of the process supported by them ;


### – they are publicly available for retrieval only where the consent of the person to whom the data has been issued has been obtained , ### – they are publicly available for retrieval only where national or union law allows for this or where the consent of the person to whom the data relates has been obtained ,


### a qualified electronic signature shall have the equivalent legal effect of a handwritten signature . ### a qualified electronic signature shall satisfy the legal requirements of a signature in relation to data in electronic form in the same manner as a handwritten signature satisfies those requirements in relation to paper - based data .


### six months after the entry into force of the regulation , the commission shall publish in the official journal of the european union the list of the electronic identification schemes which were notified pursuant to paragraph 1 and the basic information thereon . ### six months after the entry into force of the regulation , the commission shall publish in the official journal of the european union as well as on a publicly available website the list of the electronic identification schemes which were notified pursuant to paragraph 1 and the basic information thereon .


### the notifying member state ensures the availability of an authentication possibility online , at any time and free of charge so that any relying party can validate the person identification data received in electronic form . member states shall not impose any specific technical requirements on relying parties established outside of their territory intending to carry out such authentication . when either the notified identification scheme or authentication possibility is breached or partly compromised , member states shall suspend or revoke without delay the notified identification scheme or authentication possibility or the compromised parts concerned and inform the other member states and the commission pursuant to article 7 ; ### the notifying member state ensures the availability of an authentication online , at any time so that any relying party established outside of the territory of that member state can validate the person identification data received in electronic form . such authentication shall be provided free of charge where access to a service is provided online by a public sector body . member states shall not impose any disproportionate specific technical requirements on relying parties intending to carry out such authentication .


### the commission may , by means of implementing acts , establish reference numbers of standards for the security levels of electronic signature . compliance with the security level defined in a delegated act adopted pursuant to paragraph 6 shall be presumed when an electronic signature meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission shall , by means of implementing acts , establish definitions of the different security levels of electronic signatures referred to in paragraph 4 of this article and reference numbers of standards for the security levels of electronic signatures . compliance with a defined security level shall be presumed when an electronic signature meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### the supervisory body shall be responsible for the performance of the following tasks : ### the supervisory body shall perform the following tasks :


### the power to adopt delegated acts is conferred on the commission subject to the conditions laid down in this article . 2 . the power to adopt delegated acts referred to in articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall be conferred on the commission for an indeterminate period of time from the entry into force of this regulation . 3 . the delegation of power referred to in articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 28 , 29 , 30 , 31 , 35 and 37 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . 4 . as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council . 5 . a delegated act adopted pursuant to articles 8 , 13 , 15 , , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council . ### the power to adopt delegated acts is conferred on the commission subject to the conditions laid down in this article . 2 . the power to adopt delegated acts referred to in articles 8a , 15 , 16 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 shall be conferred on the commission for an indeterminate period of time from the entry into force of this regulation . 3 . the delegation of power referred to in articles 8a , 15 , 16 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . 4 . as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council . 5 . a delegated act adopted pursuant to articles 8a , 15 , 16 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council .


### a trust service provider shall be liable for any direct damage caused to any natural or legal person due to failure to comply with the obligations laid down in article 15 , unless the trust service provider can prove that he has not acted negligently . ### a trust service provider shall be liable under national law for any damage caused to an entity , natural or legal person due to non - compliance with the obligations laid down in article 15 , unless the trust service provider can prove that he has not acted negligently .


### the notifying member state takes liability for : ### the notifying member state ensures :


### this regulation applies to electronic identification provided by , on behalf or under the responsibility of member states and to trust service providers established in the union . ### this regulation applies to electronic identification mandated , recognised or issued by or on behalf of member states .


### member states shall designate an appropriate body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . supervisory bodies shall be given all supervisory and investigatory powers that are necessary for the exercise of their tasks . ### member states shall designate a supervisory body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . the designated supervisory body , its addresses and the names of responsible persons shall be communicated to the commission . supervisory bodies shall be given adequate resources necessary for the exercise of their tasks .


### qualified trust service providers issuing qualified certificates shall register in their certificate database the revocation of the certificate within ten minutes after such revocation has taken effect . ### qualified trust service providers issuing qualified certificates shall register in their certificate database the revocation of the certificate without undue delay .


### the commission may , by means of implementing acts , define the technical specifications and formats for trusted lists applicable for the purposes of paragraphs 1 to 4 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . ### the commission may , by means of implementing acts , specify the information referred to in paragraph and define the technical specifications and formats for trusted lists applicable for the purposes of paragraphs 1 to 4 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 .


### member states shall not request for accessing a service online offered by a public sector body an electronic seal with higher security assurance level than qualified electronic seals . ### member states shall not request for cross - border access to a service online offered by a public sector body an electronic seal with higher security level than qualified electronic seals .


### information on by whom the registration of the unambiguous person identifiers is managed ; ### information on who is responsible for managing the registration of the person identifiers ;


### record for an appropriate period of time all relevant information concerning data issued and received by the qualified trust service provider , in particular for the purpose of providing evidence in legal proceedings . such recording may be done electronically ; ### record for an appropriate period of time , regardless of whether the qualified trust service provider has ceased to provide qualified trust services , all relevant information concerning data issued and received by the qualified trust service provider , in particular for the purpose of providing evidence in legal proceedings . such recording may be done electronically ;


### supervisory bodies shall cooperate with a view to exchange good practice and provide each other , within the shortest possible time , with relevant information and mutual assistance so that activities can be carried out in a consistent manner . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out inspections related to the security audits as referred to in articles 15 , 16 and 17 . ### supervisory bodies shall cooperate with a view to exchanging good practice . they shall , upon justified requests , provide each other assistance so that activities can be carried out in a consistent manner . requests for assistance may cover , in particular , information requests and supervisory measures , such as requests to carry out inspections related to the compliance audits as referred to in articles 15 , 16 and 17 .


### this regulation lays down rules for electronic identification and electronic trust services for electronic transactions with a view to ensuring the proper functioning of the internal market . ### this regulation lays down rules for electronic identification and trust services for electronic transactions with a view to ensuring the proper functioning of the internal market , guaranteeing a high level of security for identification means and trust services and boosting public trust in the digital world .


### a description of the authentication possibility ; ### a description of the authentication possibility and any technical requirements imposed on relying parties ;


### ' electronic identification ' means the process of using person identification data in electronic form unambiguously representing a natural or legal person ; ### ' electronic identification ' means the process of using person identification data in electronic form representing a natural or legal person either unambiguously or to the degree necessary for the specific purpose ;


### text proposed by the commission ### article 8b right of information and access of users electronic identification schemes electronic identification schemes shall provide data subjects with information regarding the collection , communication and retention of their data , as well as the means to access their data pursuant to article 10 of directive 95 / 46 / ce .


### a qualified electronic seal shall be recognised and accepted in all member states . ### a qualified electronic seal shall be recognised in all member states .


### when issuing a qualified certificate , a qualified trust service provider shall verify , by appropriate means and in accordance with national law , the identity and , if applicable , any specific attributes of the natural or legal person to whom a qualified certificate is issued . ### when issuing a qualified certificate , a qualified trust service provider shall verify , by appropriate means and in accordance with national and union law , the identity and , if applicable , any specific attributes of the natural or legal person to whom a qualified certificate is issued .


### if an electronic seal security assurance level below the qualified electronic seal is required , in particular by a member state for accessing a service online offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic seals matching at a minimum the same security assurance level shall be accepted . ### if an electronic seal security level below the qualified electronic seal is required , in particular by a member state for accessing a service online offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic seals matching at a minimum the same security assurance level shall be accepted for access to that online service .


### a trust service provider shall be liable for any direct damage caused to any natural or legal person due to failure to comply with the obligations laid down in article 15 , unless the trust service provider can prove that he has not acted negligently . ### a trust service provider shall be liable under national law for any damage caused to an entity , natural or legal person due to non - compliance with the obligations laid down in article 15 , unless the trust service provider can prove that he has not acted negligently .


### qualified trust service providers shall be audited by a recognised independent body once a year to confirm that they and the qualified trust services provided by them fulfil the requirements set out in this regulation , and shall submit the resulting security audit report to the supervisory body . ### qualified trust service providers shall be audited by a recognised independent body every two years and following any significant technological or organizational changes to confirm that they and the qualified trust services provided by them fulfil the requirements set out in this regulation , and shall submit the resulting compliance audit report to the supervisory body .


### the supervisory body shall indicate the qualified status of the qualified service providers and the qualified trust services they provide in the trusted lists after the positive conclusion of the verification , not later than one month after the notification has been done in accordance with paragraph 1 . ### the supervisory body shall indicate the qualified status of the qualified service providers and the qualified trust services they provide in the trusted lists after the positive conclusion of the verification process without undue delay and not later than 2 weeks .


### qualified trust service providers shall notify the supervisory body of their intention to start providing a qualified trust service and shall submit to the supervisory body a security audit report carried out by a recognised independent body , as provided for in article 16 . qualified trust service providers may start to provide the qualified trust service after they have submitted the notification and security audit report to the supervisory body . ### trust service providers shall notify the supervisory body of their intention to provide a qualified trust service and shall submit to the supervisory body a security audit report carried out by a recognised independent body , as provided for in article 16 .


### a document bearing a qualified electronic signature or a qualified electronic seal of the person who is competent to issue the relevant document , shall enjoy legal presumption of its authenticity and integrity provided the document does not contain any dynamic features capable of automatically changing the document . ### a document bearing a qualified electronic signature or a qualified electronic seal shall enjoy legal presumption of its authenticity and integrity provided the document does not contain any dynamic features capable of automatically changing the document .


### qualified trust service providers issuing qualified certificates shall register in their certificate database the revocation of the certificate within ten minutes after such revocation has taken effect . ### qualified trust service providers issuing qualified certificates shall register in their certificate database the revocation of the certificate without undue delay .


### the notifying member state ensures that the person identification data are attributed unambiguously to the natural or legal person referred to in article 3 point 1 ; ### the notifying member state ensures that the person identification data are attributed to the natural or legal person referred to in article 3 point 1 either unambiguously or to the degree necessary for the specific purpose ;


### the unambiguous attribution of the person identification data referred to in point , and ### the attribution of the person identification data referred to in point , and


### ensuring that relevant information and data referred to in point of article 19 , and recorded by qualified trust service providers are preserved and kept accessible after the activities of a qualified trust service provider have ceased , for an appropriate time with a view to guaranteeing continuity of the service . ### ensuring that relevant information and data referred to in point of article 19 , and recorded by qualified trust service providers are preserved and kept accessible after the activities of a qualified trust service provider have ceased , for an appropriate time , in particular considering the validity period of the services , with a view to guaranteeing continuity of the service .


### the supervisory body concerned may also inform the public or require the trust service provider to do so , where it determines that disclosure of the breach is in the public interest . ### the competent supervisory body may also inform the public or require the trust service provider to do so , where it determines that disclosure of the breach is in the public interest .


### supervisory bodies shall cooperate with a view to exchange good practice and provide each other , within the shortest possible time , with relevant information and mutual assistance so that activities can be carried out in a consistent manner . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out inspections related to the security audits as referred to in articles 15 , 16 and 17 . ### supervisory bodies shall cooperate with a view to exchanging good practice . they shall , upon justified requests , provide each other assistance so that activities can be carried out in a consistent manner . requests for assistance may cover , in particular , information requests and supervisory measures , such as requests to carry out inspections related to the compliance audits as referred to in articles 15 , 16 and 17 .


### to enhance people ' s trust in the internal market and to promote the use of trust services and products , the notions of qualified trust services and qualified trust service provider should be introduced with a view to indicating requirements and obligations to ensure high - level security of whatever qualified trust services and products are used or provided . ### to enhance trust of small and medium enterprises and consumers in the internal market and to promote the use of trust services and products , the notions of qualified trust services and qualified trust service provider should be introduced with a view to indicating requirements and obligations to ensure high - level security of whatever qualified trust services and products are used or provided . both qualified and advanced electronic signatures may be legally equivalent to handwritten signatures . nothing in this regulation shall limit the ability of any natural or legal person to demonstrate with evidence the non - reliability of any form of electronic signature . however , in case of qualified electronic signature the burden of proof when questioning the identity of the signatory shall rest with the contesting party .


### trust services providers from third countries ### qualified trust services providers from third countries


### draft by the court of justice ### the basic principle should be that the general court should comprise at least one judge and at most two judges having the nationality of each member state .


### draft by the court of justice 7 . in article 48 , the figure ‘ 27’ shall be replaced by the figure ‘ 39’ . ### article 48 shall be replaced by the following : ' the general court shall consist of 39 judges . when , every three years , the judges are partially replaced , 20 and 19 judges shall be replaced alternately . '


### draft by the court of justice ### the 12 judges appointed following the entry into force of this regulation shall take up their posts immediately once they have taken the oath . six of them shall be chosen at random and their term of office shall end six years after the first partial replacement of the general court following the entry into force of this regulation . the term of office of the other six judges shall end six years after the second partial replacement of the general court following the entry into force of this regulation .


### appropriate safeguards with respect to the protection of personal data have been adduced in a legally binding instrument ; or ### appropriate safeguards with respect to the protection of personal data have been adduced in a legally binding instrument ; and


### the principle of fair processing requires that the data subjects should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data . ### the principle of fair and transparent processing requires that the data subjects should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data .


### member states shall ensure that , as far as possible , the different categories of personal data undergoing processing are distinguished in accordance with their degree of accuracy and reliability . ### member states should provide for specific safeguards for the processing of personal data relating of persons who have not been convicted of a criminal offence , or in relation to persons of whom there is no serious ground for believing that they have committed a criminal offence .


### processed under the responsibility and liability of the controller , who shall ensure compliance with the provisions adopted pursuant to this directive . ### processed under the responsibility and liability of the controller , who shall ensure and be able to demonstrate , for each processing operation , compliance with the provisions adopted pursuant to this directive .


### the protection of individuals should be technological neutral and not depend on the techniques used ; otherwise this would create a serious risk of circumvention . the protection of individuals should apply to processing of personal data by automated means , as well as to manual processing if the data are contained or are intended to be contained in a filing system . files or sets of files as well as their cover pages , which are not structured according to specific criteria , should not fall within the scope of this directive . this directive should not apply to the processing of personal data in the course of an activity which falls outside the scope of union law , in particular concerning national security , or to data processed by the union institutions , bodies , offices and agencies , such as europol or eurojust . ### the protection of individuals should be technological neutral and not depend on the techniques used ; otherwise this would create a serious risk of circumvention . the protection of individuals should apply to processing of personal data by automated means , as well as to manual processing if the data are contained or are intended to be contained in a filing system . files or sets of files as well as their cover pages , which are not structured according to specific criteria , should not fall within the scope of this directive . this directive should not apply to the processing of personal data in the course of an activity which falls outside the scope of union law , in particular concerning national security , or to data processed by the union institutions , bodies , offices and agencies , such as europol or eurojust or to data processed by competent organisations contributing to the fight against manipulation in sport .


### member states shall provide that where a processing operation is carried out on behalf of a controller , the controller must choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of the provisions adopted pursuant to this directive and ensure the protection of the rights of the data subject . ### member states shall provide that where a processing operation is carried out on behalf of a controller , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of the provisions adopted pursuant to this directive and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and to ensure compliance with those measures .


### member states shall ensure that records are kept of at least the following processing operations : collection , alteration , consultation , disclosure , combination or erasure . the records of consultation and disclosure shall show in particular the purpose , date and time of such operations and as far as possible the identification of the person who consulted or disclosed personal data . ### member states shall ensure that records are kept of at least the following processing operations : collection , alteration , consultation , disclosure , combination or erasure . the records of consultation and disclosure shall show in particular the purpose , date and time of such operations and the identification of the person who consulted or disclosed personal data , and the identity of the recipient of such data .


### member states shall ensure that records are kept of at least the following processing operations : collection , alteration , consultation , disclosure , combination or erasure . the records of consultation and disclosure shall show in particular the purpose , date and time of such operations and as far as possible the identification of the person who consulted or disclosed personal data . ### member states shall ensure that records are kept of at least the following processing operations : collection , alteration , consultation , disclosure , combination or erasure . the records of consultation and disclosure shall show in particular the purpose , date and time of such operations and as far as possible the identification of the person who consulted or disclosed personal data , and the identity of the recipients of such data .


### the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for ensuring compliance with the data protection rules , for assisting and advising the data subject in exercising their rights and for co - operation with the supervisory authorities of the union and of member states ; and ### the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for ensuring compliance with the data protection rules , including sufficient sanctioning powers , for assisting and advising the data subject in exercising their rights and for co - operation with the supervisory authorities of the union and of member states ; and


### member states shall provide that measures which produce an adverse legal effect for the data subject or significantly affect them and which are based solely on automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall be prohibited unless authorised by a law which also lays down measures to safeguard the data subject ' s legitimate interests . ### member states shall provide that every data subject has the right not to be subject to a measure which produces a legal effect concerning this natural person , or significantly affects this natural person , and which is based on partially or fully automated processing of personal data intended to evaluate certain personal aspects relating to this natural person .


### member states shall provide that where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers must determine the respective responsibilities for compliance with the provisions adopted pursuant to this directive , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . ### member states shall provide that where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers must determine the respective responsibilities for compliance with the provisions adopted pursuant to this directive , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of a written arrangement or a legal act .


### member states shall provide that the carrying out of processing by a processor must be governed by a legal act binding the processor to the controller and stipulating in particular that the processor shall act only on instructions from the controller , in particular , where the transfer of the personal data used is prohibited . ### member states shall provide that the carrying out of processing by means of a processor must be governed by a contract or legal act binding the processor to the controller and stipulating in particular that the processor shall : act only on instructions from the controller ; employ only staff who have agreed to be bound by an obligation of confidentiality or are under a statutory obligation of confidentiality ; take all required measures pursuant to article 28 ; engage another processor only with the permission of the controller and therefore inform the controller of the intention to engage another processor in such a timely fashion that the controller has the possibility to object ; insofar as it is possible given the nature of the processing , adopt in agreement with the controller the necessary technical and organisational requirements for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in chapter iii ; assist the controller in ensuring compliance with the obligations pursuant to articles 28 to 32 ; hand all results over to the controller after the end of the processing and not otherwise process the personal data ; make available to the controller and the supervisory authority all the information necessary to verify compliance with the obligations laid down in this article ; take into account the principle of data protection by design and default .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data which are necessary for the purposes of the processing are processed . ### the controller shall implement mechanisms for ensuring that , by default , only those personal data which are necessary for each specific purpose of the processing and are in particular not collected or retained beyond the minimum period necessary for those purposes , both in terms of the volume of the data and the time during which they are stored . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals .


### member states may determine by law categories of data processing which may wholly or partly fall under the exemptions of paragraph 1 . ### member states may determine by law categories of data processing which may wholly or partly fall under the exemptions of paragraph 1 . these exemptions , however , shall not be applied in a general way but only in specific circumstances and accompanied by a reasoned justification . the controller shall be responsible for these individual , reasoned assessments .


### accurate and , where necessary , kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ; ### accurate and kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ;


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified or singled out , directly or indirectly , alone or in combination with associated data , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to a unique identifier , an identification code , location data , online identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural , social or gender identity or sexual orientation of that person ;


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified or singled out , directly or indirectly , alone or in combination with associated data , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to a unique identifier , location data , online identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural , social or gender identity or sexual orientation of that person ;


### member states shall provide that each supervisory authority draws up an annual report on its activities . the report shall be made available to the commission and the european data protection board . ### member states shall provide that each supervisory authority draws up an annual report on its activities . the report shall be made public and available to the commission and the european data protection board .


### the commission shall be empowered to adopt delegated acts in accordance with article 56 for the purpose of specifying further the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 56 for the purpose of specifying further the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach .


### the conditions laid down in this chapter are complied with by the controller and processor . ### the other provisions adopted pursuant to this directive are complied with by the controller and processor ; and


### processed fairly and lawfully ; ### processed lawfully , fairly and in a transparent and verifiable manner in relation to the data subject ;


### member states shall provide for the right of the data subject to request , in particular in cases referred to in article 13 , that the supervisory authority checks the lawfulness of the processing . ### member states shall provide for the right of the data subject to request , at all times , in particular in cases referred to in article 13 , that the supervisory authority checks the lawfulness of the processing .


### adequate , relevant , and not excessive in relation to the purposes for which they are processed ; ### adequate , relevant , and limited to the minimum necessary in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ;


### third parties to the criminal offence , such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings , or a person who can provide information on criminal offences , or a contact or associate to one of the persons mentioned in and ; and ### third parties to the criminal offence , such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings , or a person who can provide information on criminal offences , or a contact or associate to one of the persons mentioned in and ;


### if a processor processes personal data other than as instructed by the controller , the processor shall be considered to be a controller in respect of that processing and shall be subject to the rules on joint controllers laid down in article 20 . ### if a processor is instructed by the controller to make certain independent decisions regarding the personal data , the processor shall be considered to be a controller in respect of that processing and shall be subject to the rules on joint controllers laid down in article 20 .


### where the commission has taken no decision pursuant to article 34 , member states shall provide that a transfer of personal data to a recipient in a third country or an international organisation may take place where : ### the commission has taken no decision pursuant to article 34 , member states shall provide that a transfer of personal data to a recipient in a third country or an international organisation may only take place where :


### member states shall provide that measures which produce an adverse legal effect for the data subject or significantly affect them and which are based solely on automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall be prohibited unless authorised by a law which also lays down measures to safeguard the data subject ' s legitimate interests . ### member states shall provide that every data subject has the right not to be subject to a measure which produces a legal effect concerning this natural person , or significantly affects this natural person , and which is based on partially or fully automated processing of personal data intended to evaluate certain personal aspects relating to this natural person .


### the commission shall be empowered to adopt delegated acts in accordance with article 56 for the purpose of specifying further the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach . ### the commission , after consultation of the european data protection board , shall be empowered to adopt delegated acts in accordance with article 56 for the purpose of specifying further the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach .


### member states shall provide that the controller and the processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected , having regard to the state of the art and the cost of their implementation . ### member states shall provide that the controller and the processor implements appropriate technical and organisational measures and procedures to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected , having regard to the state of the art and the cost of their implementation .


### a personal data breach may , if not addressed in an adequate and timely manner , result in harm , including reputational damage to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , it should notify the breach to the competent national authority . the individuals whose personal data or privacy could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of an individual where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation in connection with the processing of personal data . ### a personal data breach may , if not addressed in an adequate and timely manner , result in harm , including reputational damage to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , it should notify the breach to the competent national authority . the individuals whose personal data or privacy could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of an individual where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation or economic or social loss in connection with the processing of personal data .


### member states shall provide that any transfer of personal data by competent authorities that is undergoing processing or is intended for processing after transfer to a third country , or to an international organisation , including further onward transfer to another third country or international organisation , may take place only if : the transfer is necessary for the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties ; and the conditions laid down in this chapter are complied with by the controller and processor . ### member states shall provide that any transfer of personal data by competent authorities that is undergoing processing or is intended for processing after transfer to a third country , or to an international organisation , including further onward transfer to another third country or international organisation , may take place only if : the specific transfer is necessary for the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties ; the data are transferred to a controller in a third country or international organisation that is an public authority competent for the purposes referred in article 1 ; the conditions laid down in articles 34 to 37 are complied with by the controller and the processor , including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation ; the other provisions adopted pursuant to this directive are complied with by the controller and processor ; and the level of protection of the personal data individuals guaranteed in the union by this directive is not undermined . 2 . member states shall provide that a transfer , subject to the conditions set out in paragraph 1 , may only take place : where the commission has decided under the conditions and procedure referred to in article 34 that the third country or international organisation in question ensures an adequate level of protection ; or where appropriate safeguards with respect to the protection of personal data have been adduced in a legally binding instrument as referred to in article 35 .


### any company that issues transferable securities which are admitted to trading on regulated markets shall arrange for such securities to be represented in book - entry form as immobilisation through the issuance of a global note , which represents the whole issue , or subsequent to a direct issuance of the securities into a dematerialised form . ### any legal entity that issues transferable securities which are admitted to trading on regulated markets shall arrange for such securities to be represented in book - entry form as immobilisation through the issuance of a global note , which represents the whole issue , or subsequent to a direct issuance of the securities into a dematerialised form .


### any question with respect to proprietary aspects in relation to financial instruments held by a csd shall be governed by the law of the country where the account is maintained . ### without prejudice to articles 2 , 9 and 10 of directive 98 / 26 / ec , any question with respect to proprietary aspects in relation to financial instruments held by a csd shall be governed by the law of the country where the account is maintained . the account shall be presumed to be maintained at the place where the csd has its habitual residence as determined by article 19 of regulation no 593 / 2008 of the european parliament and the council .


### the labelling , presentation and advertising of food referred to in article 1 shall provide adequate consumer information and must not be misleading . ### the labelling , presentation and advertising of food referred to in article 1 must not be misleading and shall : provide adequate consumer information ; and be based on the advice of independent persons having qualifications in medicine , nutrition or pharmacy , taking into account the specific needs of the persons for whom the food is intended .


### the european parliament and the council shall have access to the information referred to in paragraph 1 . ### the european parliament , the council and the member states shall have equal access to the information referred to in paragraph 1 . to that end , the european parliament and the council shall be sent , at the same time as the members of the committees and on the same terms , all information referred to in paragraph 1 .


### ' if , at the end of the two month period , a competent authority has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall await any decision that the european banking authority may take in accordance with article 11 of that regulation , and shall act in conformity with that decision . the two month period shall be deemed the conciliation period within the meaning of that regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the two month period or after a joint decision has been reached ' . ### ' if , at the end of the initial two month period , any of the competent authorities concerned has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the competent authorities of the host member state shall await the decision that the european banking authority may take in accordance with article 11 of that regulation to settle the matter in order to ensure compliance with eu law , and shall take their final decision in conformity with the authority ' s decision . the authority ' s decision shall not replace the prudential judgement of the competent authorities of the member state . the two month period shall be deemed the conciliation period within the meaning of that regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the initial two month period or after a joint decision has been reached ' .


### if , at the end of the two month period , a competent authority has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall await any decision that the european banking authority may take in accordance with article 11 of that regulation , and shall act in conformity with that decision . the two month period shall be deemed the conciliation period within the meaning of that regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the two month period or after a joint decision has been reached . ### if , at the end of the two month period following receipt of a request under the first subparagraph any of the competent authorities concerned has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the competent authorities of the host member state shall await the decision that the european banking authority may take in accordance with article 11 of that regulation to settle the matter in order to ensure compliance with union law , and shall take their final decision in conformity with the authority ' s decision . the authority ' s decision shall not replace the prudential judgement of the competent authorities of the member state . the two month period shall be deemed the conciliation period within the meaning of that regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of that two month period or after a joint decision has been reached .


### if , at the end of the six month period , a competent authority has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall await any decision that the european banking authority may take in accordance with article 11 of that regulation , and shall act in conformity with that decision . the six month period shall be deemed the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the six month period or after a joint decision has been reached ### if , at the end of the six - month period , any of the competent authorities concerned has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall defer its decision and await any decision that the european banking authority may take in accordance with article 11 of that regulation on its decision , and shall take its decision in conformity with the european banking authority ' s decision . the six - month period shall be deemed to be the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the six - month period or after a joint decision has been reached . decisions taken by the european banking authority shall not replace the lawful exercise of judgment by the competent authorities of the consolidating supervisor pursuant to this directive .


### in the absence of such a joint decision between the competent authorities within four months , a decision on the application of articles 123 and 124 and article 136 shall be taken on a consolidated basis by the consolidating supervisor after duly considering the risk assessment of subsidiaries performed by relevant competent authorities . if , at the end of the four month period , a competent authority has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall await any decision that the european banking authority may take in accordance with article 11 of that regulation , and shall act in conformity with that decision . the four month period shall be deemed the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the four month period or after a joint decision has been reached . ### in the absence of such a joint decision between the competent authorities within four months , a decision on the application of articles 123 and 124 and article 136 shall be taken on a consolidated basis by the consolidating supervisor after duly considering the risk assessment of subsidiaries performed by relevant competent authorities . if , at the end of the four month period , any of the competent authorities concerned has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall defer its decision and await any decision that the european banking authority may take in accordance with article 11 of that regulation to settle the matter in order to ensure compliance with union law , and shall take its final decision in conformity with the authority ' s decision . the authority ' s decision according to the precautionary principle shall not replace the consolidating supervisor ' s additional prudential judgement . the four month period shall be deemed the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the four month period or after a joint decision has been reached .


### in order to ensure uniform application of this article and to take account of technical developments on financial markets , the european securities and markets authority shall develop draft technical standards to determine the conditions of application of the obligation to provide a supplement to the prospectus in case of a significant new factor , material mistake or inaccuracy relating to the information included in the prospectus . the authority shall submit those draft technical standards to the commission by 1 january 2014 . ### in order to ensure uniform application of this article and to take account of technical developments on financial markets , the european securities and markets authority shall determine what constitutes a significant new factor , material mistake or inaccuracy referred to in paragraph 1 and shall develop draft technical standards to determine the conditions of application of the obligation to provide a supplement to the prospectus in case of a significant new factor , material mistake or inaccuracy relating to the information included in the prospectus . the authority shall submit those draft technical standards to the commission by 1 january 2014 .


### ' in the absence of such a joint decision between the competent authorities within four months , a decision on the application of articles 123 and 124 and article 136 shall be taken on a consolidated basis by the consolidating supervisor after duly considering the risk assessment of subsidiaries performed by relevant competent authorities . if , at the end of the four month period , a competent authority has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall await any decision that the european banking authority may take in accordance with article 11 of that regulation , and shall act in conformity with that decision . the four month period shall be deemed the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the four month period or after a joint decision has been reached . ' ### ' in the absence of such a joint decision between the competent authorities within four months , a decision on the application of articles 123 and 124 and article 136 shall be taken on a consolidated basis by the consolidating supervisor after duly considering the risk assessment of subsidiaries performed by relevant competent authorities . if , at the end of the four month period , any of the competent authorities concerned has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall defer their decision and await any decision that the european banking authority may take in accordance with article 11 of that regulation to settle the matter in order to ensure compliance with union law , and shall take its final decision in conformity with the authority ' s decision . the authority ' s decision according to the precautionary principle shall not replace the consolidating supervisor ' s additional prudential judgement . the four month period shall be deemed the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the four month period or after a joint decision has been reached . '


### if , at the end of the two month period , a competent authority has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall await any decision that the european banking authority may take in accordance with article 11 of that regulation , and shall act in conformity with that decision . the two month period shall be deemed the conciliation period within the meaning of that regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the two month period or after a joint decision has been reached . ### if , at the end of the two month period following receipt of a request under the first subparagraph any of the competent authorities concerned has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the competent authorities of the host member state shall await the decision that the european banking authority may take in accordance with article 11 of that regulation to settle the matter in order to ensure compliance with eu law , and shall take their final decision in conformity with the authority ' s decision . the two month period shall be deemed the conciliation period within the meaning of that regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of that two month period or after a joint decision has been reached .


### in the absence of such a joint decision between the competent authorities within four months , a decision on the application of articles 123 and 124 and article 136 shall be taken on a consolidated basis by the consolidating supervisor after duly considering the risk assessment of subsidiaries performed by relevant competent authorities . if , at the end of the four month period , a competent authority has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall await any decision that the european banking authority may take in accordance with article 11 of that regulation , and shall act in conformity with that decision . the four month period shall be deemed the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the four month period or after a joint decision has been reached . ### in the absence of such a joint decision between the competent authorities within four months , a decision on the application of articles 123 and 124 and article 136 shall be taken on a consolidated basis by the consolidating supervisor after duly considering the risk assessment of subsidiaries performed by relevant competent authorities . if , at the end of the four month period , any of the competent authorities concerned has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall defer its decision and await any decision that the european banking authority may take in accordance with article 11 of that regulation to settle the matter in order to ensure compliance with union law , and shall take its final decision in conformity with the authority ' s decision . the authority ' s decision according to the precautionary principle shall take into consideration the consolidating supervisor ' s additional prudential judgement . the four month period shall be deemed the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the four month period or after a joint decision has been reached .


### member states shall establish a register of all investment firms . the register shall be publicly accessible and shall contain information on the services or activities for which the investment firm is authorised . it shall be updated on a regular basis . the european securities and markets authority established by regulation… / …of the european parliament and of the council shall establish a list of all investment firms in the community . the european securities and markets authority shall publish that list and shall keep it up to date . ### member states shall register all investment firms which provide services or carry out activities within their sphere of authority . a systematically updated list of those firms shall be transferred to the european securities and markets authority established by regulation… / …of the european parliament and of the council . the european supervisory authority shall establish a register of all investment firms in the union . the register shall be publicly accessible and shall contain information on the services or activities for which the investment firm is authorised . it shall be updated on a regular basis . where a competent authority has withdrawn an authorisation in accordance with article 8 to , the withdrawal shall be published in the register for a period of two years .


### ' where an emergency situation , including adverse developments in financial markets , arises , which potentially jeopardises the market liquidity and the stability of the financial system in any of the member state where entities of a group have been authorised or where significant branches referred to in article 42a are established , the consolidating supervisor shall , subject to chapter 1 , section 2 , alert as soon as is practicable , the european banking authority and the authorities referred to in the fourth subparagraph of article 49 and article 50 , and shall communicate all information essential for the pursuance of their tasks . those obligations shall apply to all competent authorities under articles 125 and 126 and to the competent authority identified under article 129 . ### ' where a potential or effective emergency situation , including any potential adverse developments in financial markets or in real economy , arises , which potentially jeopardises the market liquidity and the stability of the financial system in any of the member state where entities of a group have been authorised or where significant branches referred to in article 42a are established , the consolidating supervisor shall , subject to chapter 1 , section 2 , alert as soon as is practicable , the european banking authority and the authorities referred to in the fourth subparagraph of article 49 and article 50 , and shall communicate all information essential for the pursuance of their tasks . those obligations shall apply to all competent authorities under articles 125 and 126 and to the competent authority identified under article 129 .


### in the absence of such a joint decision between the competent authorities within four months , a decision on the application of articles 123 and 124 and article 136 shall be taken on a consolidated basis by the consolidating supervisor after duly considering the risk assessment of subsidiaries performed by relevant competent authorities . if , at the end of the four month period , a competent authority has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall await any decision that the european banking authority may take in accordance with article 11 of that regulation , and shall act in conformity with that decision . the four month period shall be deemed the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the four month period or after a joint decision has been reached . ### in the absence of such a joint decision between the competent authorities within four months , a decision on the application of articles 123 and 124 and article 136 shall be taken on a consolidated basis by the consolidating supervisor after duly considering the risk assessment of subsidiaries performed by relevant competent authorities . if , at the end of the four - month period , any of the competent authorities concerned has referred the matter to the european banking authority in accordance with article 11 of regulation … / … [ eba ] , the consolidating supervisor shall defer its decision and await any decision that the european banking authority may take in accordance with article 11 of that regulation on its decision , and shall take its decision in conformity with the european banking authority ' s decision . the four - month period shall be deemed to be the conciliation period within the meaning of the regulation . the european banking authority shall take its decision within one month . the matter shall not be referred to the authority after the end of the four - month period or after a joint decision has been reached . decisions taken by the european banking authority shall not replace the lawful exercise of judgment by the competent authorities of the consolidating supervisor pursuant to this directive .


### member states shall recognise as meeting the requirements of their national rules transposing article 15 any insolvency protection obtained by an organiser or a retailer facilitating the procurement of assisted travel arrangements under the rules of its member state of establishment transposing article 15 . ### member states shall recognise as meeting the requirements of their national rules transposing article 15 any insolvency protection obtained by an organiser or a retailer under the rules of its member state of establishment transposing article 15 .


### member states shall designate central contact points to facilitate the administrative cooperation and supervision of organisers and retailers facilitating the procurement of assisted travel arrangements operating in different member states . they shall notify the contact details of these contact points to all other member states and the commission . ### member states shall designate central contact points to facilitate the administrative cooperation and supervision of organisers and retailers operating in different member states . they shall notify the contact details of these contact points to all other member states and the commission .


### if a member state has doubts about the insolvency protection of an organiser or of a retailer facilitating the procurement of assisted travel arrangements which is established in a different member state and is operating on its territory , it shall seek clarification from the member state of establishment . member states shall respond to requests from other member states at the latest within 15 working days of receiving them . ### if a member state has doubts about the insolvency protection of an organiser or of a retailer which is established in a different member state and is operating on its territory , it shall seek clarification from the member state of establishment . member states shall respond to requests from other member states at the latest within 15 working days of receiving them .


### the minimum number of persons required for the package to take place and a time - limit of at least 20 days before the start of the package for the possible cancellation if that number is not reached ; ### the minimum number of persons required for the package to take place and a time - limit for the possible cancellation if that number is not reached ;


### the categories of consumers at risk when using the product , in particular vulnerable consumers ; ### the categories of consumers at risk when using the product , in particular vulnerable consumers , such as children , older people and the disabled ;


### in the light of advice from ices and stecf certain technical conservation measures in the west of scotland , celtic sea and irish sea to protect rockall haddock , cod , haddock and whiting stocks should be maintained to contribute to the conservation of fish stocks . ### in the light of advice from ices and stecf certain technical conservation measures in the west of scotland , celtic sea and irish sea , to protect cod , haddock and whiting stocks should be maintained to contribute to the conservation of fish stocks .


### ‘ health institution’ means an organisation whose primary purpose is the care or treatment of patients or the promotion of public health ; ### ‘ health institution’ means an organisation whose primary purpose is the care or treatment of patients or the promotion of public health , with the exclusion of laboratories providing commercial clinical services ;


### devices classified as class d in accordance with the rules set out in annex vii , even if manufactured and used within a single health institution , shall comply with the requirements of this regulation . however , the provisions regarding ce marking set out in article 16 and the obligations referred to in articles 21 to 25 shall not apply to those devices . ### devices classified as class d in accordance with the rules set out in annex vii , if manufactured and used within a single health institution , shall be exempt from the requirements of this regulation , with the exception of article 59 and general safety performance requirements set out in annex 1 where the following conditions are met : the recipient patient or patient group ' s specific needs can not be met by an available ce - marked device ; the health institution is accredited to iso standard 15189 quality management system , or any other equivalent recognised standard ; the health institution provides the competent authority referred to in article 26 with a list of such devices , which shall include a justification of their manufacturing , modification or use , in particular , where similar devices have been made available on the market . this information shall be made public . member states shall retain the right to restrict the in - house manufacture and use of any specific type of in - vitro diagnostic device in relation to aspects that are not covered by this regulation , and may also make the manufacture and use of the devices concerned subject to further safety requirements .


### devices classified as class d in accordance with the rules set out in annex vii , even if manufactured and used within a single health institution , shall comply with the requirements of this regulation . however , the provisions regarding ce marking set out in article 16 and the obligations referred to in articles 21 to 25 shall not apply to those devices . ### devices classified as class d in accordance with the rules set out in annex vii , if manufactured and used within a single health institution , shall be exempt from the requirements of this regulation , with the exception of article 59 , where the following conditions are met ; the recipient patient or patient group ' s specific needs can not be met by an available ce - marked device ; the health institution is accredited to en iso standard 15189 quality management system , or any other equivalent recognised standard ; the health institution provides their competent authority referred to in article 26 with a list of such devices , which shall include a justification of their manufacturing or modification , in particular , where similar devices have been made available on the market . this information shall be updated yearly , and shall be made public .


### the information mentioned in paragraph 1 shall be immediately transmitted through the electronic system to all competent authorities concerned and be accessible to the member states and to the commission . ### the information mentioned in paragraph 1 shall be immediately transmitted through the electronic system to all competent authorities concerned and be accessible to the member states and to the commission . the commission , in consultation with the medical devices coordination group , shall provide an overview of this information , every 6 months , for the public and healthcare professionals . this information shall be accessible through the european databank in article 25 .


### with the exception of article 59 , the requirements of this regulation shall not apply to devices classified as class a , b and c , in accordance with the rules set out in annex vii , and manufactured and used only within a single health institution , provided manufacture and use occur solely under the health institution’s single quality management system , and the health institution is compliant with standard en iso 15189 or any other equivalent recognised standard . member states may require that the health institutions submit to the competent authority a list of such devices which have been manufactured and used on their territory and may make the manufacture and use of the devices concerned subject to further safety requirements . ### with the exception of article 59 , the requirements of this regulation shall not apply to laboratory - developed tests manufactured and used only within a single health institution , provided manufacture and use occur solely under the health institution’s single quality management system , and the health institution is accredited to standard en iso 15189 or any other equivalent recognised standard . member states may require that the health institutions submit to the competent authority a list of such devices which have been manufactured and used on their territory and may make the manufacture and use of the devices concerned subject to further safety requirements .


### the non - interest - bearing deposit should be released upon correction of the excessive deficit while the interest on such deposits and the fines collected should be distributed among member states whose currency is the euro which do not have an excessive deficit and which are not the subject of an excessive imbalance procedure either . ### the non - interest - bearing deposit should be released upon correction of the excessive deficit or excessive government debt while the interest on such deposits and the fines collected should be allocated to the permanent crisis mechanism . until the establishment of the european monetary fund , those fines shall be credited to the european financial stability facility .


### the interest earned by the commission on deposits lodged in accordance with article 4 and the fines collected in accordance with article 5 shall constitute other revenue referred to in article 311 of the treaty , and shall be distributed , in proportion to their share in the gross national income of the eligible member states , among member states whose currency is the euro which do not have an excessive deficit as determined in accordance with article 126 of the treaty and which are not the subject of an excessive imbalance procedure within the meaning of regulation no [ … / … ] . ### the interest earned by the commission on deposits lodged in accordance with article 4 and the fines collected in accordance with article 5 shall be allocated to a permanent crisis mechanism . until the establishment of such a fund , the fines should be credited to the european financial stability facility .


### carriers shall set up or have in place a complaint handling mechanism for rights and obligations covered by this regulation . ### carriers and terminal operators shall set up or have in place independent complaint handling mechanisms in accessible formats and the customary languages for rights and obligations covered by this regulation . particular attention shall be paid to the needs of people with disabilities and persons with reduced mobility .


### carriers shall set up or have in place a complaint handling mechanism for rights and obligations covered by this regulation . ### carriers and terminal operators shall set up or have in place an accessible complaint handling mechanism for rights and obligations covered by this regulation .