# Official Journal C 167/2020

| | ISSN 1977-091X |
| --- | --- |
| Official Journal
  of the European Union | C 167 |
| | |
| English edition | Information and Notices | Volume 6315 May 2020 |

ISSN 1977-091X

Official Journal

of the European Union

C 167

English edition

Information and Notices

Volume 6315 May 2020

---

| Contents | page |
| --- | --- |
| | II   Information |
| | INFORMATION FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES |
| | European Commission |
| 2020/C 167/01 | Commission Notice Guidelines on annual audit reports to be submitted in accordance with Article 15(8) of Directive 2014/40/EU in the context of the EU traceability system for tobacco products (
  1
  ) | 1 |
| 2020/C 167/02 | Non-opposition to a notified concentration (Case M.9763 — Bidvest Group/PHS Group) (
  1
  ) | 10 |
| 2020/C 167/03 | Non-opposition to a notified concentration (Case M.9794 – Renault/Ferrovial/Car Sharing Mobility Services) (
  1
  ) | 11 |
| 2020/C 167/04 | Non-opposition to a notified concentration (Case M.9772 – Helvetia/CASER) (
  1
  ) | 12 |
| 2020/C 167/05 | Withdrawal of notification of a concentration (Case M.9097 – Boeing/Embraer) (
  1
  ) | 13 |

Contents

page

II   Information

INFORMATION FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES

European Commission

2020/C 167/01

Commission Notice Guidelines on annual audit reports to be submitted in accordance with Article 15(8) of Directive 2014/40/EU in the context of the EU traceability system for tobacco products (
  1
  )

1

1

2020/C 167/02

Non-opposition to a notified concentration (Case M.9763 — Bidvest Group/PHS Group) (
  1
  )

1

10

2020/C 167/03

Non-opposition to a notified concentration (Case M.9794 – Renault/Ferrovial/Car Sharing Mobility Services) (
  1
  )

1

11

2020/C 167/04

Non-opposition to a notified concentration (Case M.9772 – Helvetia/CASER) (
  1
  )

1

12

2020/C 167/05

Withdrawal of notification of a concentration (Case M.9097 – Boeing/Embraer) (
  1
  )

1

13

---

| | IV   Notices |
| --- | --- |
| | NOTICES FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES |
| | European Commission |
| 2020/C 167/06 | Euro exchange rates — 14 May 2020 | 14 |
| 2020/C 167/07 | New national side of euro coins intended for circulation | 15 |
| | NOTICES FROM MEMBER STATES |
| 2020/C 167/08 | Information to be provided pursuant to Article 5(2) Establishment of a European Grouping of Territorial Cooperation (EGTC)
  (Regulation (EC) No 1082/2006 of the European Parliament and of the Council of 5 July 2006 ( OJ L 210, 31.7.2006, p. 19 )) | 16 |

IV   Notices

NOTICES FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES

European Commission

2020/C 167/06

Euro exchange rates — 14 May 2020

14

2020/C 167/07

New national side of euro coins intended for circulation

15

NOTICES FROM MEMBER STATES

2020/C 167/08

Information to be provided pursuant to Article 5(2) Establishment of a European Grouping of Territorial Cooperation (EGTC)
  (Regulation (EC) No 1082/2006 of the European Parliament and of the Council of 5 July 2006 ( OJ L 210, 31.7.2006, p. 19 ))

(Regulation (EC) No 1082/2006 of the European Parliament and of the Council of 5 July 2006 ( OJ L 210, 31.7.2006, p. 19 ))

16

---

| | V   Announcements |
| --- | --- |
| | PROCEDURES RELATING TO THE IMPLEMENTATION OF COMPETITION POLICY |
| | European Commission |
| 2020/C 167/09 | Prior notification of a concentration (Case M.9730 – FCA/PSA) (
  1
  ) | 18 |
| 2020/C 167/10 | Prior notification of a concentration (Case M.9743 – Atresmedia/Telefónica/JV) (
  1
  ) | 20 |

V   Announcements

PROCEDURES RELATING TO THE IMPLEMENTATION OF COMPETITION POLICY

European Commission

2020/C 167/09

Prior notification of a concentration (Case M.9730 – FCA/PSA) (
  1
  )

1

18

2020/C 167/10

Prior notification of a concentration (Case M.9743 – Atresmedia/Telefónica/JV) (
  1
  )

1

20

---

| | |
| --- | --- |
| | (1)   Text with EEA relevance. |

---

(1)   Text with EEA relevance.

1

| EN | |
| --- | --- |

EN

---

II Information

INFORMATION FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES

European Commission

| 15.5.2020 | EN | Official Journal of the European Union | C 167/1 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/1

---

COMMISSION NOTICE

Guidelines on annual audit reports to be submitted in accordance with Article 15(8) of Directive 2014/40/EU in the context of the EU traceability system for tobacco products

(Text with EEA relevance)

(2020/C 167/01)

DISCLAIMER: The aim of this document is to provide guidance to an approved auditor on the scope of the audit and the procedure for submitting the annual audit report. It is not legally binding but provides general guidelines with recommendations and reflects on best practices. These guidelines are without prejudice to any national rules.

1.   Introduction

Articles 15 of Directive 2014/40/EU of the European Parliament and of the Council (1) provide for the establishment of an EU-wide system of traceability for tobacco products in order to address the issue of illicit trade. The system became operational on 20 May 2019.

As part of that system Article 15(8) of Directive 2014/40/EU requires Member States to ensure that manufacturers and importers of tobacco products conclude data storage contracts with an independent third party (‘third-party provider’) for the purpose of establishing a data storage facility to host data related to tobacco products of individual manufacturers and importers (‘primary repository’).

To safeguard the independent operation of the traceability system, Article 15(8) of Directive 2014/40/EU stipulates that an external auditor shall monitor the activities of the primary repository and its third-party provider. The auditor shall be proposed and paid by the tobacco manufacturer, and be approved by the Commission. The external auditor shall submit its assessment by means of an annual report to the national competent authorities and to the Commission assessing in particular any irregularities in relation to access.

This document is intended to provide guidance to an approved auditor on the scope of the audit and the procedure for submitting the annual audit report. It should be read in conjunction with Commission Implementing Regulation (EU) 2018/574 (2), which sets out the technical requirements for the establishment and operation of the traceability system, including for primary repositories and Commission Delegated Regulation (EU) 2018/573 (3) defining the key elements of data storage contracts to be concluded as part of a traceability system.

This document is offered as a tool to assist approved auditors; these are non-binding guidelines and they do not create any new legal obligations. To the extent that these guidelines may interpret legislation, the Commission’s position is without prejudice to any interpretation of this Directive that may be issued by the Court of Justice of the European Union.

2.   General context of audits

Each primary repository contracted by a manufacturer is subject to an annual audit process. Where the same third-party provider operates two or more primary repositories, a separate audit should be carried out and a separate audit report should be submitted for each repository.

An audit should be conducted in relation to a primary repository and its related services, including an assessment of whether the respective third-party provider and, if applicable, its sub-contractors comply with the relevant legislative requirements set out in Directive 2014/40/EU, Implementing Regulation (EU) 2018/574 and Delegated Regulation (EU) 2018/573.

Each manufacturer or importer must notify the Commission of the auditor it proposes to audit its primary repository and the respective third-party provider. All proposed auditors are subject to approval by the Commission.

3.   Scope of audits

Scope and objective

Audit reports should be submitted in order to inform the national competent authorities and the Commission about the findings of auditors, in particular concerning any irregularities in relation to access to the data stored by primary repositories.

Audit reports should dedicate separate chapters to each of the six domains outlined below. Each chapter should address the verification points of the respective domain, as listed in the checklist provided in the Annex.

Audits should be carried out in accordance with that checklist, which sets out the required domains and verification points in line with ISO/IEC 27001:2013 on Information Security Management Systems (4). To that end, auditors should note that Article 10 of Commission Delegated Regulation (EU) 2018/573 refers to ISO/IEC 27001:2013 as the preferred information security management standard in the context of operating primary repositories.

| Domain | Objectives |
| --- | --- |
| Organisational and physical security | To establish a management framework for information security within the organisation.
  To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.
  To prevent unauthorised physical access, damage or interference to organisation, including information and information processing facilities.
  To prevent loss, damage, theft or compromise of assets and interruption to the organisation’s operations. |
| Operations Security | To ensure correct and secure operations of information processing facilities.
  To protect against loss of data.
  To record events and generate evidence.
  To ensure integrity of operational systems.
  To prevent exploitation of technical vulnerabilities. |
| Access control (users and applications) | To limit access to information and information processing facilities.
  To ensure authorised user access and to prevent unauthorised access to system and services.
  To make users accountable for safeguarding their authentication information.
  To prevent unauthorised access to systems and applications.
  To ensure that information security is designed and implemented within the development lifecycle of information systems. |
| Communications security | To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information.
  To ensure the protection of information in networks and its supporting information processing facilities.
  To maintain the security of information transferred within the organisation and within external entities. |
| Business continuity | To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses.
  Information security continuity shall be embedded in the organisation business continuity management systems.
  To ensure availability of information processing facilities.
  To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements. |
| Assets and Data integrity | To identify the organisational assets and define the appropriate protection responsibilities.
  To ensure that information receives an appropriate level of protection.
  To prevent unauthorised disclosure, modification, removal or destruction of information stored on media. |

Domain

Objectives

Organisational and physical security

To establish a management framework for information security within the organisation.

To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.

To prevent unauthorised physical access, damage or interference to organisation, including information and information processing facilities.

To prevent loss, damage, theft or compromise of assets and interruption to the organisation’s operations.

Operations Security

To ensure correct and secure operations of information processing facilities.

To protect against loss of data.

To record events and generate evidence.

To ensure integrity of operational systems.

To prevent exploitation of technical vulnerabilities.

Access control (users and applications)

To limit access to information and information processing facilities.

To ensure authorised user access and to prevent unauthorised access to system and services.

To make users accountable for safeguarding their authentication information.

To prevent unauthorised access to systems and applications.

To ensure that information security is designed and implemented within the development lifecycle of information systems.

Communications security

To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information.

To ensure the protection of information in networks and its supporting information processing facilities.

To maintain the security of information transferred within the organisation and within external entities.

Business continuity

To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses.

Information security continuity shall be embedded in the organisation business continuity management systems.

To ensure availability of information processing facilities.

To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements.

Assets and Data integrity

To identify the organisational assets and define the appropriate protection responsibilities.

To ensure that information receives an appropriate level of protection.

To prevent unauthorised disclosure, modification, removal or destruction of information stored on media.

Conclusions and recommendations

Conclusions of an audit should be provided for each verification point listed in the checklist.

An audit report should only highlight and elaborate findings related to non-compliance issues or other identified risks. Findings should also be accompanied by appropriate recommendations setting out the actions required to eliminate the issues and shortcomings identified during the audit.

4.   Procedural aspects

Frequency

Auditors are required to submit their audit reports on an annual basis. Since the traceability system became operational on 20 May 2019, auditors are invited to submit their first annual audit reports, covering the first operational year of the traceability system (i.e. 20 May 2019 to 19 May 2020), by 30 November 2020. Thereafter, auditors are invited to submit annual reports for subsequent operational years by the end of October of each calendar year.

Audit follow-up

Where a follow-up is carried out to assess whether the concerned third-party provider has adequately implemented the recommendations of the annual audit report, the auditor, where possible, is invited to submit the results to the Commission and to the national competent authorities within three months from the submission of the annual audit report.

5.   Procedural aspects of audit reports

Information on auditors

The names of the auditor(s) and, where applicable, the associated audit firm(s), should be indicated in the introduction of the audit report.

Format

The audit report should be provided in electronic format (searchable, non-protected PDF).

If possible, the auditors are invited to submit the annual reports to the Commission in English.

Submission procedure

The annual audit report and any follow up to such report, should be submitted electronically via email to SANTE-TT-SW@ec.europa.eu with the following subject: ‘Audit report [Follow-up to the audit report] for [year] – [Name of contracting manufacturer] – [Name of audited third-party provider]’

Transparency

In order to promote the overall transparency and accountability of the traceability system for tobacco products, the Commission invites the manufacturers, on a voluntary basis, to agree with their respective auditors to submit to the Commission also a public version of their audit report, excluding any personal and commercially sensitive data.

Such public versions of the audit reports would be published on Commission’s dedicated webpage.

---

(1)  Directive 2014/40/EU of the European Parliament and of the Council of 3 April 2014 on the approximation of the laws, regulations and administrative provisions of the Member States concerning the manufacture, presentation and sale of tobacco and related products and repealing Directive 2001/37/EC (OJ L 127, 29.4.2014, p. 1).

(2)  Commission Implementing Regulation (EU) 2018/574 of 15 December 2017 on technical standards for the establishment and operation of a traceability system for tobacco products (OJ L 96, 16.4.2018, p. 7).

(3)  Commission Delegated Regulation (EU) 2018/573 of 15 December 2017 on key elements of data storage contracts to be concluded as part of a traceability system for tobacco products (OJ L 96, 16.4.2018, p. 1).

(4)  ISO/IEC 27001:2013. Information technology – Security techniques – Information security management systems – Requirements. The requirements set out in ISO/IEC 27001:2013 are generic and are intended to be applicable to all organisations, regardless of type, size or nature.

---

ANNEX

Checklist for audits of primary repositories

| Domain | Verification points (1) | Regulatory guidance | Evidence guidance |
| --- | --- | --- | --- |
| Organisational and physical security | A.6 Organisation of Information Security







  — | A.6.1 Internal Organisation |

Domain

Verification points (1)

Regulatory guidance

Evidence guidance

Organisational and physical security

A.6 Organisation of Information Security

—

A.6.1 Internal Organisation

| — | A.6.2 Mobile Devices and teleworking |
| --- | --- |

—

A.6.2 Mobile Devices and teleworking

A.7 Human resource Security

| — | A7.1 Prior to Employment |
| --- | --- |

—

A7.1 Prior to Employment

| — | A7.2 During Employment |
| --- | --- |

—

A7.2 During Employment

| — | A7.3 Termination and Change of Employment |
| --- | --- |

—

A7.3 Termination and Change of Employment

A.11 Physical and Environmental security

| — | A.11.1 Secure Areas |
| --- | --- |

—

A.11.1 Secure Areas

| — | A.11.2 Equipment |
| --- | --- |

—

A.11.2 Equipment

On A.6 and A.11:

The repository must be physically located on the territory of the EU. Data must not be stored in or transferred to a third country. (Art. 15(8) Directive 2014/40/EU)

The repository must be guarded by security procedures and systems ensuring that access to the repository is only granted to competent authorities of Member States, the Commission and external auditors.

On A.7:

The provider of the repository, as well as any of its subcontractor(s), must be independent and exercise their functions impartially. The requirements on legal independence, financial independence, and absence of conflict of interest, apply. (Art. 35 of Implementing Regulation (EU) 2018/574)

Organisation’s organigram in place, job descriptions signed by key personnel, attended courses of relevance for the respective roles.

List of appointments (CISO, DPO, etc.), and description of responsibilities and tasks for security roles.

Evidence of personnel attendance at training (e.g. accepted invitation, date and agenda of training, signed participation list during the awareness workshop, etc.).

Policies/procedures for Human Resource security regularly reviewed and updated (procedures execution records).

Basic implementation of physical security measures and control of the surroundings, such as door and cabinet locks, burglar alarm, fire alarms, fire extinguishers, CCTVs, etc.

List of personnel with authorised access and authorisation credentials.

Documented policy for physical security measures and control of the surroundings, including description of the relevant facilities and systems.

Detailed inventory with hardware resources used for administration purposes.

Operations Security

A.12 Operations Security

| — | A.12.1 Operational procedures and responsibilities |
| --- | --- |

—

A.12.1 Operational procedures and responsibilities

| — | A.12.3 Backup |
| --- | --- |

—

A.12.3 Backup

| — | A.12.4 Logging and monitoring |
| --- | --- |

—

A.12.4 Logging and monitoring

| — | A.12.5 Control of operational software |
| --- | --- |

—

A.12.5 Control of operational software

| — | A.12.6 Technical vulnerability management |
| --- | --- |

—

A.12.6 Technical vulnerability management

On A.12.3:

All repository components and services must have sufficient back-up mechanisms in place. (Art. 25(1)(i) of Implementing Regulation (EU) 2018/574)

On A.12.4:

The repository must contain a complete audit trail of all operations concerning the stored data and users performing related operations, including the nature of these operations and the history of user access. (Art. 25(1)(m) of Implementing Regulation (EU) 2018/574)

Guidelines on evidence in relation to events and logging:

| — | login and logoff attempts (both successful and unsuccessful attempts) |
| --- | --- |

—

login and logoff attempts (both successful and unsuccessful attempts)

| — | database server restarts |
| --- | --- |

—

database server restarts

| — | commands issued by users with system administrator privileges |
| --- | --- |

—

commands issued by users with system administrator privileges

| — | attempted integrity violations (where changed or inserted data does not match a referential, unique, or check constraint) |
| --- | --- |

—

attempted integrity violations (where changed or inserted data does not match a referential, unique, or check constraint)

| — | select, insert, update, and delete operations |
| --- | --- |

—

select, insert, update, and delete operations

| — | stored procedure executions |
| --- | --- |

—

stored procedure executions

| — | unsuccessful attempts to access a database or a table (authorisation failures) |
| --- | --- |

—

unsuccessful attempts to access a database or a table (authorisation failures)

| — | changes to system catalogue tables |
| --- | --- |

—

changes to system catalogue tables

Maintenance security procedure properly documented and approved by senior management.

Clearly defined minimum security maintenance process.

List of all contracts with third parties (2).

Explicit security requirements in the contracts with third parties supplying IT products, IT services, outsourced business processes, helpdesks, etc.

Documented security policy for contracts with third parties

Documented comments or change logs of the policy.

Vendor risk assessment/management policy and/or procedure in place and maintained.

Documented amendment or termination of relationships with third parties.

Reports from related awareness and training exercises.

Systems, tools and procedures for incident detection and analysis.

Documented incident detection and analysis policy, addressing purpose, scope, roles and responsibilities and coordination among all related entities, including clients.

Existence of reports related to the detection and escalation of past security incidents.

Up-to-date documentation of the incident detection policy and related procedures and systems.

Inventory of major past incidents detected and escalated, including all related information (cause, impact, order of actions taken).

Evidence of past cyber exercises conducted, including the dates when they were conducted.

Access control (users and applications)

A.9 Access Control

| — | A.9.1 Business requirements of access control |
| --- | --- |

—

A.9.1 Business requirements of access control

| — | A.9.2 User Access Management |
| --- | --- |

—

A.9.2 User Access Management

| — | A.9.3 User Responsibilities |
| --- | --- |

—

A.9.3 User Responsibilities

| — | A.9.4 System and application access control |
| --- | --- |

—

A.9.4 System and application access control

A.14 System Acquisition, Development and Maintenance

| — | A.14.2 Security in development and support processes |
| --- | --- |

—

A.14.2 Security in development and support processes

On A.9:

Access to data facilities, and the data stored therein, must be limited to Member States, the European Commission, and approved external auditors. (Art. 15(8) of Directive 2014/40/EU; Art. 25(1)(j) of Implementing Regulation (EU) 2018/574)

Access control policy including description of roles, groups, access rights, procedures for granting and revoking the right to access the information systems.

Rule definition for deleting no longer used accounts after a short period of time.

Access control related matrices (e.g. control matrix for segregation of duties, remote access control, etc.).

Access rights section included in access control policy/procedures.

The access control policy includes a register of mapping of access rights to the relevant resources and/or processes.

Tailored and documented administration accounts with specific access rights given to the relevant personnel.

Documented management of administrator accounts process.

Logs of administrator account activity available.

Administration information systems isolated and segregated from the rest of the infrastructure for enhanced resilience.

Formally documented software requirements for ensuring compatibility.

Communications security

A.10 Cryptographics

| — | A.10.1 Cryptographic controls |
| --- | --- |

—

A.10.1 Cryptographic controls

A.13 Communications security

| — | A.13.1 Network Security Management |
| --- | --- |

—

A.13.1 Network Security Management

| — | A.13.2 Information Transfer |
| --- | --- |

—

A.13.2 Information Transfer

On A.13:

Data exchange between primary repositories and the secondary repository and router must take place in accordance with the technical specifications set out by the provider of the secondary repository. (Art. 28(1) of Implementing Regulation (EU) 2018/574)

All electronic communication must be carried out using secure means. Applicable security protocols and connectivity rules must be based on non-proprietary open standards. (Art. 36(1) of Implementing Regulation (EU) 2018/574)

Appropriate cryptographic processes exist.

Safeguards to protect the secrecy of (private) key(s) are in place.

System configuration policy and/or procedure in place and maintained.

System configuration tables.

Timetable and plan of system configuration review cycles.

Documented past exercises/tests of critical information systems in place.

Timetable and plan of security configuration reviews.

Documentation about the implementation of the segregation of the network and system and of the data.

Monitoring reports of critical network and information systems.

Documented policy for monitoring procedures, including minimum monitoring requirements.

Proof of existing tools for monitoring systems.

Business continuity

A.16 Information security incident Management

| — | A.16.1 Management of Information Security incidents and improvements |
| --- | --- |

—

A.16.1 Management of Information Security incidents and improvements

A.17 Information Security Aspects of Business Continuity Management

| — | A.17 Information security aspects of business continuity Management |
| --- | --- |

—

A.17 Information security aspects of business continuity Management

| — | A.17.1 information Security continuity |
| --- | --- |

—

A.17.1 information Security continuity

| — | A.17.2 Redundancy |
| --- | --- |

—

A.17.2 Redundancy

A.18 Compliance

| — | A.18.1 Compliance with legal and contractual requirements |
| --- | --- |

—

A.18.1 Compliance with legal and contractual requirements

On A.17:

All repository components and services must meet a monthly uptime of at least 99,5 %. (Art. 25(1)(i) of Implementing Regulation (EU) 2018/574)

Data portability must be secured in accordance with the applicable common data dictionary. (Art. 36(2) of Implementing Regulation (EU) 2018/574)

Provider must have in place an applicable exit plan. (Art. 19 of Delegated Regulation (EU) 2018/573)

On A.18.1:

Data processing activities must comply with Regulation (EU) 2016/679 (the General Data Protection Regulation), and be in line with the Data Processing Agreement (DPA) established between the provider of the primary repository and the provider of the secondary repository.

Formally documented service continuity strategy, including recovery time objectives for key services and processes.

Contingency plans for critical systems, including clear steps and procedures for common threats, triggers for activation, steps and recovery time objectives.

Records of individual training activities as well as post-exercise reports.

Measures in place for dealing with disasters (e.g. earthquake, flooding, fire), such as failover sites in other regions, backups of critical data that need to be carried out in a remote location (geographically distinct from the data centre collecting and processing the data), at a sufficient distance to escape any damage from a disaster at the main site etc.

Formally documented policy/procedures for deploying disaster recovery capabilities, including list of natural and/or major disasters that could affect the services, and a list of disaster recovery capabilities (either those available internally or provided by third parties).

Records of individual training activities for personnel involved in the disaster recovery operations.

Assets and Data integrity

A.8 Asset Management

| — | A.8.1 Responsibility for assets |
| --- | --- |

—

A.8.1 Responsibility for assets

| — | A.8.2 Information Classification |
| --- | --- |

—

A.8.2 Information Classification

| — | A.8.3 Media Handling |
| --- | --- |

—

A.8.3 Media Handling

On A.8.1:

Consider assets related with databases and repositories (i.e. database management system, database objects, database server).

On A.8.2:

High sensitivity. Data contains trade sensitive information. Data is used for investigations conducted by national and EU authorities.

Documented policy/procedures for asset management, including roles, responsibilities, assets and configurations that are subject to the policy.

List of centrally managed critical assets and critical system configurations managed and maintained.

Software/hardware asset management formally documented and maintained.

Up to date asset management policy/procedures, review comments and/or change logs.

---

(1)  The numbering of the verification points corresponds to the numbering in ISO/IEC 27001:2013. In case of deviations, reference should be made to the numbering used in this document.

(2)  A third party is an independent entity that is involved in the functioning of a service but is not the principal one and has a lesser interest in the service provision (e.g. upstream (supplier, vendor) or downstream (distributor, reseller).

---

| 15.5.2020 | EN | Official Journal of the European Union | C 167/10 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/10

---

Non-opposition to a notified concentration

(Case M.9763 — Bidvest Group/PHS Group)

(Text with EEA relevance)

(2020/C 167/02)

On 28 April 2020, the Commission decided not to oppose the above notified concentration and to declare it compatible with the internal market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004 (1). The full text of the decision is available only in English and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32020M9763. EUR-Lex is the on-line access to European law. |
| --- | --- |

—

in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32020M9763. EUR-Lex is the on-line access to European law.

---

(1)  OJ L 24, 29.1.2004, p. 1.

---

| 15.5.2020 | EN | Official Journal of the European Union | C 167/11 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/11

---

Non-opposition to a notified concentration

(Case M.9794 – Renault/Ferrovial/Car Sharing Mobility Services)

(Text with EEA relevance)

(2020/C 167/03)

On 8 May 2020, the Commission decided not to oppose the above notified concentration and to declare it compatible with the internal market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004 (1). The full text of the decision is available only in English and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32020M9794. EUR-Lex is the online access to European law. |
| --- | --- |

—

in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32020M9794. EUR-Lex is the online access to European law.

---

(1)  OJ L 24, 29.1.2004, p. 1.

---

| 15.5.2020 | EN | Official Journal of the European Union | C 167/12 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/12

---

Non-opposition to a notified concentration

(Case M.9772 – Helvetia/CASER)

(Text with EEA relevance)

(2020/C 167/04)

On 7 May 2020, the Commission decided not to oppose the above notified concentration and to declare it compatible with the internal market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004 (1). The full text of the decision is available only in English and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32020M9772. EUR-Lex is the online access to European law. |
| --- | --- |

—

in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32020M9772. EUR-Lex is the online access to European law.

---

(1)  OJ L 24, 29.1.2004, p. 1.

---

| 15.5.2020 | EN | Official Journal of the European Union | C 167/13 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/13

---

Withdrawal of notification of a concentration

(Case M.9097 – Boeing/Embraer)

(Text with EEA relevance)

(2020/C 167/05)

Council Regulation (EC) No 139/2004

On 30 August 2019, the European Commission received notification (1) of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (2) (‘Merger Regulation’).

On 4 October 2019, the Commission decided to initiate proceedings (3) under Article 6(1)(c) of the Merger Regulation.

Based on statements by the parties and evidence in the file, the concentration, as notified by the parties, was considered to have been abandoned for the purposes of the application of the EU Merger Regulation.

---

(1)  OJ C 304, 9.9.2019, p. 3.

(2)  OJ L 24, 29.1.2004, p. 1.

(3)  OJ C 347, 14.10.2019, p. 8.

---

IV Notices

NOTICES FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES

European Commission

| 15.5.2020 | EN | Official Journal of the European Union | C 167/14 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/14

---

Euro exchange rates (1)

14 May 2020

(2020/C 167/06)

1 euro =

| | Currency | Exchange rate |
| --- | --- | --- |
| USD | US dollar | 1,0792 |
| JPY | Japanese yen | 115,48 |
| DKK | Danish krone | 7,4573 |
| GBP | Pound sterling | 0,88495 |
| SEK | Swedish krona | 10,6418 |
| CHF | Swiss franc | 1,0512 |
| ISK | Iceland króna | 158,30 |
| NOK | Norwegian krone | 11,0598 |
| BGN | Bulgarian lev | 1,9558 |
| CZK | Czech koruna | 27,571 |
| HUF | Hungarian forint | 354,66 |
| PLN | Polish zloty | 4,5666 |
| RON | Romanian leu | 4,8375 |
| TRY | Turkish lira | 7,5159 |
| AUD | Australian dollar | 1,6805 |
| CAD | Canadian dollar | 1,5224 |
| HKD | Hong Kong dollar | 8,3647 |
| NZD | New Zealand dollar | 1,8068 |
| SGD | Singapore dollar | 1,5374 |
| KRW | South Korean won | 1 329,17 |
| ZAR | South African rand | 20,1637 |
| CNY | Chinese yuan renminbi | 7,6655 |
| HRK | Croatian kuna | 7,5730 |
| IDR | Indonesian rupiah | 16 134,80 |
| MYR | Malaysian ringgit | 4,6843 |
| PHP | Philippine peso | 54,591 |
| RUB | Russian rouble | 80,0145 |
| THB | Thai baht | 34,675 |
| BRL | Brazilian real | 6,3925 |
| MXN | Mexican peso | 26,2470 |
| INR | Indian rupee | 81,5920 |

Currency

Exchange rate

USD

US dollar

1,0792

JPY

Japanese yen

115,48

DKK

Danish krone

7,4573

GBP

Pound sterling

0,88495

SEK

Swedish krona

10,6418

CHF

Swiss franc

1,0512

ISK

Iceland króna

158,30

NOK

Norwegian krone

11,0598

BGN

Bulgarian lev

1,9558

CZK

Czech koruna

27,571

HUF

Hungarian forint

354,66

PLN

Polish zloty

4,5666

RON

Romanian leu

4,8375

TRY

Turkish lira

7,5159

AUD

Australian dollar

1,6805

CAD

Canadian dollar

1,5224

HKD

Hong Kong dollar

8,3647

NZD

New Zealand dollar

1,8068

SGD

Singapore dollar

1,5374

KRW

South Korean won

1 329,17

ZAR

South African rand

20,1637

CNY

Chinese yuan renminbi

7,6655

HRK

Croatian kuna

7,5730

IDR

Indonesian rupiah

16 134,80

MYR

Malaysian ringgit

4,6843

PHP

Philippine peso

54,591

RUB

Russian rouble

80,0145

THB

Thai baht

34,675

BRL

Brazilian real

6,3925

MXN

Mexican peso

26,2470

INR

Indian rupee

81,5920

---

(1)  Source: reference exchange rate published by the ECB.

---

| 15.5.2020 | EN | Official Journal of the European Union | C 167/15 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/15

---

New national side of euro coins intended for circulation

(2020/C 167/07)

Image 1

National side of the new commemorative 2-euro coin intended for circulation and issued by Monaco

Euro coins intended for circulation have legal tender status throughout the euro area. For the purpose of informing the public and all parties who handle the coins, the Commission publishes a description of the designs of all new coins (1). In accordance with the Council conclusions of 10 February 2009 (2), euro-area Member States and countries that have concluded a monetary agreement with the European Union providing for the issuing of euro coins are allowed to issue commemorative euro coins intended for circulation, provided that certain conditions are met, particularly that only the 2-euro denomination is used. These coins have the same technical characteristics as other 2-euro coins, but their national face features a commemorative design that is highly symbolic in national or European terms.

Issuing country: Monaco

Subject of commemoration: The 300th anniversary of the birth of Prince Honoré III

Description of the design: The design shows the effigy of Prince Honoré III. At the left is the inscription ‘HONORÉ III’ and at the right the name of the issuing country ‘MONACO’. At the bottom, in semi-circle, is the inscription ‘1720 – Naissance – 2020’.

The coin’s outer ring depicts the 12 stars of the European flag.

Number of coins to be issued: 15 000

Date of issue: 1 June 2020

---

(1)  See OJ C 373, 28.12.2001, p. 1 for the national faces of all the coins issued in 2002.

(2)  See the conclusions of the Economic and Financial Affairs Council of 10 February 2009 and the Commission Recommendation of 19 December 2008 on common guidelines for the national sides and the issuance of euro coins intended for circulation (OJ L 9, 14.1.2009, p. 52).

---

NOTICES FROM MEMBER STATES

| 15.5.2020 | EN | Official Journal of the European Union | C 167/16 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/16

---

Information to be provided pursuant to Article 5(2)

Establishment of a European Grouping of Territorial Cooperation (EGTC)

(Regulation (EC) No 1082/2006 of the European Parliament and of the Council of 5 July 2006 (OJ L 210, 31.7.2006, p. 19))

(2020/C 167/08)

I.1)   Name, address and contact point

| Registered name: Proximity GECT |
| --- |
| Registered office: Agenzia di Sviluppo ‘La Cittadella del Sapere’ c/da Calda n° 8 – 85043 Latronico (Potenza) |
| Contact point:. |

Registered name: Proximity GECT

Registered office: Agenzia di Sviluppo ‘La Cittadella del Sapere’ c/da Calda n° 8 – 85043 Latronico (Potenza)

Contact point:.

Institutional manager to the EU institutions

Stavros Kalogiannis (+ 30 6972806280, st.kalogiannis@yahoo.gr)

President

Giuseppe Suanno (+ 39 3351025960, presproximitygect@gmail.com)

Director-general

Gilberto Zinzani (+ 39 3388489471, dirgproximitygect@gmail.com)

Email: proximitygect@pec.it

Internet address of the Grouping: www.proximitygect.eu

I.2)   Duration of the Grouping:

Duration of the grouping: unlimited

Date of registration: 24.12.2019

II.   OBJECTIVES

Proximity GECT is a pilot project at European level in the Adriatic-Ionian macro-region (EUSAIR). It pursues a strategy linked to the Mediterranean, and in particular the EUSAIR strategy for the area of the Adriatic-Ionian macro-region, in order to achieve the following objectives and in view of the very close historical and cultural ties, shared traditions and relations between the resident populations (Magna Graecia):

| (a) | strengthen the economic, social and cultural links between the populations of its members; |
| --- | --- |

(a)

strengthen the economic, social and cultural links between the populations of its members;

| (b) | work towards the development of the territory of its members within their respective remits by focusing particularly on the following areas of cooperation: research and innovation; culture and tourism, sustainable mobility and trans-European transport networks; healthcare; mountain economy and environment; promotion of internet, social and film multimedia. |
| --- | --- |

(b)

work towards the development of the territory of its members within their respective remits by focusing particularly on the following areas of cooperation: research and innovation; culture and tourism, sustainable mobility and trans-European transport networks; healthcare; mountain economy and environment; promotion of internet, social and film multimedia.

More specifically:

| — | culture: digitalisation of cultural systems (exhibitions – collaboration between museums) and an integrated system for harnessing cultural and environmental heritage, atlas of paths, |
| --- | --- |

—

culture: digitalisation of cultural systems (exhibitions – collaboration between museums) and an integrated system for harnessing cultural and environmental heritage, atlas of paths,

| — | healthcare: innovation strategy and joint prevention campaigns and initiatives in the health sector, |
| --- | --- |

—

healthcare: innovation strategy and joint prevention campaigns and initiatives in the health sector,

| — | economy, agriculture and mountain environment: staging events on the climate and on parks in the Epirus and Basilicata regions, |
| --- | --- |

—

economy, agriculture and mountain environment: staging events on the climate and on parks in the Epirus and Basilicata regions,

| — | management of the innovative ‘product club’ system in Italy and Greece in the EUSAIR concerning the areas of Slow and Sustainable Intermodality, National Cycle Paths and Culture-Environment-Tourism, |
| --- | --- |

—

management of the innovative ‘product club’ system in Italy and Greece in the EUSAIR concerning the areas of Slow and Sustainable Intermodality, National Cycle Paths and Culture-Environment-Tourism,

| — | taking part in the Agenda for EU Mountainous Regions, |
| --- | --- |

—

taking part in the Agenda for EU Mountainous Regions,

| — | Sustainable Intermodality (national cycle path network) and Intermodality with secondary and tourist railways and river systems. |
| --- | --- |

—

Sustainable Intermodality (national cycle path network) and Intermodality with secondary and tourist railways and river systems.

III.   ADDITIONAL DETAILS ON NAME OF THE GROUPING

Name in English: EGTC Proximity

Name in French: GECT Proximité

IV.   MEMBERS

| IV.1) | Total number of members in the Grouping: 2 |
| --- | --- |

IV.1)

| IV.2) | Nationalities of the members of the Grouping: Italy, Greece |
| --- | --- |

IV.2)

| IV.3) | Member information (1)






  Official name: Basilicata Region |
| --- | --- |
| Postal address: Viale Vincenzo Verrastro, 4, 85100 Potenza, Italy |
| Internet address: www.regione.basilicata.it |
| Type of member: Regional authority |

IV.3)

Official name: Basilicata Region

Postal address: Viale Vincenzo Verrastro, 4, 85100 Potenza, Italy

Internet address: www.regione.basilicata.it

Type of member: Regional authority

| Official name: Epirus Region |
| --- |
| Postal address: Pyrrhus Square 1, 45521, Ioannina, Greece |
| Internet address: www.php.gov.gr |
| Type of member: Regional authority |

Official name: Epirus Region

Postal address: Pyrrhus Square 1, 45521, Ioannina, Greece

Internet address: www.php.gov.gr

Type of member: Regional authority

---

(1)  Please add for each member.

---

V Announcements

PROCEDURES RELATING TO THE IMPLEMENTATION OF COMPETITION POLICY

European Commission

| 15.5.2020 | EN | Official Journal of the European Union | C 167/18 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/18

---

Prior notification of a concentration

(Case M.9730 – FCA/PSA)

(Text with EEA relevance)

(2020/C 167/09)

1.

This notification concerns the following undertakings:

| — | Peugeot S.A. (‘PSA’, France), |
| --- | --- |

—

Peugeot S.A. (‘PSA’, France),

| — | Fiat Chrysler Automobiles N.V. (‘FCA’, the Netherlands), controlled by EXOR N.V. |
| --- | --- |

—

Fiat Chrysler Automobiles N.V. (‘FCA’, the Netherlands), controlled by EXOR N.V.

PSA enters into a full merger within the meaning of Article 3(1)(a) of the Merger Regulation with FCA.

2.

| — | FCA is active worldwide in the manufacture, supply and distribution of passenger vehicles and light commercial vehicles under the brands Fiat, Chrysler, Jeep, ALFA Romeo, Lancia, Abarth, Dodge, Ram, and Fiat Professional. In addition, FCA owns the automotive cast components business Teksid S.p.A., the plastic components and modules business Plastic Components and Modules Automotive S.p.A. and the automotive production systems business Comau S.p.A.. It also provides retail and dealers financing to support the sales of its branded vehicles, |
| --- | --- |

—

FCA is active worldwide in the manufacture, supply and distribution of passenger vehicles and light commercial vehicles under the brands Fiat, Chrysler, Jeep, ALFA Romeo, Lancia, Abarth, Dodge, Ram, and Fiat Professional. In addition, FCA owns the automotive cast components business Teksid S.p.A., the plastic components and modules business Plastic Components and Modules Automotive S.p.A. and the automotive production systems business Comau S.p.A.. It also provides retail and dealers financing to support the sales of its branded vehicles,

| — | PSA is active worldwide in the manufacture, supply and distribution of passenger vehicles and light commercial vehicles under the Peugeot, Citroën, Opel, Vauxhall and DS brands. Through its subsidiary, Faurecia S.A., it is also active in the manufacture and supply of interior automotive components. PSA also provides ancillary services such as financing solutions for the acquisition of motor vehicles, as well as mobility services and solutions. |
| --- | --- |

—

PSA is active worldwide in the manufacture, supply and distribution of passenger vehicles and light commercial vehicles under the Peugeot, Citroën, Opel, Vauxhall and DS brands. Through its subsidiary, Faurecia S.A., it is also active in the manufacture and supply of interior automotive components. PSA also provides ancillary services such as financing solutions for the acquisition of motor vehicles, as well as mobility services and solutions.

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of the Merger Regulation. However, the final decision on this point is reserved.

4.

Observations must reach the Commission not later than 10 days following the date of this publication. The following reference should always be specified:

M.9730 – FCA/PSA

Observations can be sent to the Commission by email, by fax, or by post. Please use the contact details below:

Email: COMP-MERGER-REGISTRY@ec.europa.eu

Fax +32 22964301

Postal address:

| European Commission |
| --- |
| Directorate-General for Competition |
| Merger Registry |
| 1049 Bruxelles/Brussel |
| BELGIQUE/BELGIË |

European Commission

Directorate-General for Competition

Merger Registry

1049 Bruxelles/Brussel

BELGIQUE/BELGIË

---

(1)  OJ L 24, 29.1.2004, p. 1 (the ‘Merger Regulation’).

1

---

| 15.5.2020 | EN | Official Journal of the European Union | C 167/20 |
| --- | --- | --- | --- |

15.5.2020

EN

Official Journal of the European Union

C 167/20

---

Prior notification of a concentration

(Case M.9743 – Atresmedia/Telefónica/JV)

(Text with EEA relevance)

(2020/C 167/10)

1.

This notification concerns the following undertakings:

| — | Atresmedia Corporación de Medios de Comunicación, S.A. (‘Atresmedia’, Spain), controlled by the Planeta group, |
| --- | --- |

—

Atresmedia Corporación de Medios de Comunicación, S.A. (‘Atresmedia’, Spain), controlled by the Planeta group,

| — | Telefónica Audiovisual Digital, S.L.U. (‘Telefónica’, Spain), belonging to the Telefónica group, |
| --- | --- |

—

Telefónica Audiovisual Digital, S.L.U. (‘Telefónica’, Spain), belonging to the Telefónica group,

| — | Sociedad Comercializadora (the ‘Joint Venture’ or ‘JV’, Spain). |
| --- | --- |

—

Sociedad Comercializadora (the ‘Joint Venture’ or ‘JV’, Spain).

Atresmedia and Telefónica acquire within the meaning of Article 3(1)(b) and 3(4) of the Merger Regulation joint control of the JV.

The concentration is accomplished by way of purchase of shares in a newly created company constituting a joint venture.

2.

| — | For Atresmedia: supply of free-to-air TV channels (including Antena 3, La Sexta, Neox, Nova, Mega and Atreseries) and the sale of TV advertising space in Spain. |
| --- | --- |

—

For Atresmedia: supply of free-to-air TV channels (including Antena 3, La Sexta, Neox, Nova, Mega and Atreseries) and the sale of TV advertising space in Spain.

| — | For Telefónica: acquisition of content and editing of channels for the configuration of the pay-TV platform Movistar+ and sale of TV advertising space in Spain. Telefónica is a subsidiary of the multinational Telefónica group, which is active in the supply of internet, telephony and pay-TV services under different commercial brands, such as Movistar and O2. In Spain, the Telefónica Group is a supplier of pay-TV services through its brand Movistar+. |
| --- | --- |

—

For Telefónica: acquisition of content and editing of channels for the configuration of the pay-TV platform Movistar+ and sale of TV advertising space in Spain. Telefónica is a subsidiary of the multinational Telefónica group, which is active in the supply of internet, telephony and pay-TV services under different commercial brands, such as Movistar and O2. In Spain, the Telefónica Group is a supplier of pay-TV services through its brand Movistar+.

| — | For the JV: the creation, production and distribution of audiovisual content, in particular series, films and unscripted content in Spanish. |
| --- | --- |

—

For the JV: the creation, production and distribution of audiovisual content, in particular series, films and unscripted content in Spanish.

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of the Merger Regulation. However, the final decision on this point is reserved.

4.

Observations must reach the Commission not later than 10 days following the date of this publication. The following reference should always be specified:

M.9743 – Atresmedia/Telefónica/JV

Observations can be sent to the Commission by email, by fax, or by post. Please use the contact details below:

Email: COMP-MERGER-REGISTRY@ec.europa.eu

Fax +32 22964301

Postal address:

| European Commission |
| --- |
| Directorate-General for Competition |
| Merger Registry |
| 1049 Bruxelles/Brussel |
| BELGIQUE/BELGIË |

European Commission

Directorate-General for Competition

Merger Registry

1049 Bruxelles/Brussel

BELGIQUE/BELGIË

---

(1)  OJ L 24, 29.1.2004, p. 1 (the ‘Merger Regulation’).

1

---