EN Official Journal of the European Union L 283/5

COMMISSION REGULATION (EC) No 1023/2009

of 29 October 2009

implementing Regulation (EC) No 808/2004 of the European Parliament and of the Council concerning Community statistics on the information society

(Text with EEA relevance)

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Regulation (EC) No 808/2004 of the European Parliament and of the Council of 21 April 2004 concerning Community statistics on the information society (1), and in particular Article 8(2) thereof,

Whereas:

(1) Regulation (EC) No 808/2004 established a common framework for the systematic production of Community statistics on the information society.

(2) Pursuant to Article 8(1) of Regulation (EC) No 808/2004, implementing measures are necessary to determine the data to be supplied for preparation of the statistics referred to in Articles 3 and 4 of that Regulation and the deadlines for their transmission.

(3) The measures provided for in this Regulation are in accordance with the opinion of the European Statistical System Committee established by Regulation (EC) No 223/2009 of the European Parliament and of the Council (2) on European statistics,

HAS ADOPTED THIS REGULATION:

Article 1

The data to be transmitted for the production of Community statistics on the information society as referred to in Articles 3(2) and 4 of Regulation (EC) No 808/2004 shall be as specified in Annexes I and II to this Regulation.

Article 2

This Regulation shall enter into force on the 20th day following its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 29 October 2009. For the Commission Joaquín ALMUNIA Member of the Commission

(1) OJ L 143, 30.4.2004, p. 49.

(2) OJ L 87, 31.3.2009, p. 164.

ANNEX I MODULE 1: ENTERPRISES AND THE INFORMATION SOCIETY 1. SUBJECTS AND THEIR CHARACTERISTICS (a) The subjects to be covered for the reference year 2010, selected from the list in Annex I to Regulation (EC) No 808/2004, are the following: — ICT systems and their usage in enterprises, — use of the Internet and other electronic networks by enterprises, — e-commerce and e-business processes, — ICT security, — ICT investment and expenditure. (b) The following enterprise characteristics are to be collected: ICT systems and their usage in enterprises Characteristics to be collected for all enterprises: — computer usage. Characteristics to be collected for enterprises that use computers: — (optional) percentage of persons employed using computers at least once a week, — use of an internal computer network (e.g. LAN), — use of an internal home page (intranet), — use of extranet, — use of free or open-source operating systems, such as Linux (i.e. with its source code available, no copyright cost, and the possibility to modify and/or (re)distribute it). Characteristics to be collected for enterprises that use an internal computer network (e.g. LAN): — use of wireless access within the internal computer network (e.g. LAN). Use of the Internet and other electronic networks by enterprises Characteristics to be collected for enterprises that use computers: — access to the Internet. Characteristics to be collected for enterprises that have access to the Internet: — percentage of persons employed using computers connected to the World Wide Web at least once a week, — Internet connection: traditional modem or ISDN, — Internet connection: DSL, — Internet connection: other fixed Internet connection, — Internet connection: mobile broadband connection, — (optional) Internet connection: mobile broadband connection via 3G handset, — (optional) Internet connection: mobile broadband connection via portable computer using 3G modem, — Internet connection: other mobile connection, — (optional) Internet usage for banking and financial services, — (optional) Internet usage for training and education, — Internet usage for interaction with public authorities, in the previous calendar year, — use of website, — use of digital signature in any message sent, i.e. using encryption methods that assure the authenticity and integrity of the message (uniquely linked to and capable of identifying the signatory and where any subsequent change to the message is detectable). Characteristics to be collected for enterprises that interacted with public authorities via the Internet, in the previous calendar year: — Internet usage for obtaining information from public authorities’ websites, in the previous calendar year, — Internet usage for obtaining forms from public authorities’ websites, in the previous calendar year, — Internet usage for returning filled-in forms to public authorities, in the previous calendar year, — Internet usage for handling an administrative procedure completely electronically without the need for additional paperwork, in the previous calendar year, — Internet usage for submitting a proposal in an electronic tender system (public e-procurement), in the previous calendar year. Characteristics to be collected for enterprises that have a website: — (optional) provision of the following facility: privacy policy statement, privacy seal or certification of website safety, — (optional) provision of the following facility: product catalogues or price lists, — (optional) provision of the following facility: possibility for visitors to customise or design products, — (optional) provision of the following facility: online ordering or reservation or booking facility, — (optional) provision of the following facility: online order tracking facility, — (optional) provision of the following facility: personalised content for regular/repeated visitors, — (optional) provision of the following facility: advertisement of open job positions or online job application. E-commerce and e-business processes Characteristics to be collected for enterprises that use computers: — use of automated data exchange (ADE), defined as the sending and/or receiving of messages via any computer networks in an agreed or standard format which allows their automatic processing without the individual message being manually typed, — electronic and automatic sharing of relevant information about sales orders received (either electronically or not) with the inventory management function, — electronic and automatic sharing of relevant information about sales orders received (either electronically or not) with the accounting function, — electronic and automatic sharing of relevant information about sales orders received (either electronically or not) with the production or services management function, — electronic and automatic sharing of relevant information about sales orders received (either electronically or not) with the distribution management function, — electronic and automatic sharing of relevant information about purchase orders sent (either electronically or not) with the inventory management function, — electronic and automatic sharing of relevant information about purchase orders sent (either electronically or not) with the accounting function, — use of ERP (enterprise resource planning) software package to share internally information between different functional areas (e.g. accounting, planning, production, marketing), — use of any software application for managing information about clients (customer relationship management — CRM) to capture, store and make available to other business functions information about clients, — use of any software application for managing information about clients (CRM) to analyse the information about clients for marketing purposes (setting prices, making sales promotions, choosing distribution channels, etc.). Characteristics to be collected for enterprises that use automated data exchange: — use of ADE for: sending orders to suppliers, — use of ADE for: receiving e-invoices, — use of ADE for: receiving orders from customers, — use of ADE for: sending e-invoices, — use of ADE for: sending or receiving product information, — use of ADE for: sending or receiving transport documents, — (optional) use of ADE for: sending payment instructions to financial institutions, — (optional) use of ADE for: sending or receiving data to/from public authorities. Characteristics to be collected for enterprises that use computers and are not classified in Section K of NACE Rev. 2: — electronic sharing of supply-chain management information with customers or suppliers, — sending of orders via computer networks, in the previous calendar year, — receiving of orders via computer networks, in the previous calendar year. Characteristics to be collected for enterprises that share supply-chain management information with customers or suppliers and are not classified in Section K of NACE Rev. 2: — exchange of information with suppliers on inventory, production, demand forecasts or progress of deliveries, — exchange of information with customers on inventory, production, demand forecasts or progress of deliveries, — (optional) exchange of information with suppliers or customers via websites, — (optional) exchange of information with suppliers or customers via electronic transmission allowing automatic processing (e.g. EDI-type systems, XML, Edifact, etc.). Characteristics to be collected for enterprises that have received orders via computer networks and are not classified in Section K of NACE Rev. 2: — percentage of total turnover resulting from orders received via computer networks, in the previous calendar year, — percentage of e-commerce sales resulting from orders received via websites, in the previous calendar year, — percentage of e-commerce sales resulting from orders received via electronic transmission allowing automatic processing (e.g. EDI-type systems, XML, Edifact, etc.), in the previous calendar year, — use of secure protocols (SSL/TLS) in receiving orders via the Internet, Characteristics to be collected for enterprises that have sent orders via computer networks and are not classified in Section K of NACE Rev. 2: — percentage of total purchase value resulting from orders placed via computer networks, in percentage classes, in the previous calendar year ([0;<1], [1;<5], [5;<10], [10;<25], [25;<50], [50;<75], [75;100]), ICT security Characteristics to be collected for enterprises that use computers: — percentage of enterprises with a formally defined ICT security policy with a plan for regular review, — percentage of enterprises making staff aware of their obligations regarding ICT security via compulsory training or presentations, — percentage of enterprises making staff aware of their obligations regarding ICT security through a contract, including contract of employment, — percentage of enterprises making staff aware of their obligations regarding ICT security through offers of voluntary training or generally available information (e.g. via the Intranet, newsletters or paper documents), — percentage of enterprises affected by ICT-related security incidents resulting in unavailability of ICT services, destruction or corruption of data due to hardware or software failures, — percentage of enterprises affected by ICT-related security incidents resulting in unavailability of ICT services due to attacks from outside, e.g. denial-of-service attacks, — percentage of enterprises affected by ICT-related security incidents resulting in destruction or corruption of data due to infection by malicious software or unauthorised access, — percentage of enterprises affected by ICT-related security incidents resulting in disclosure of confidential data due to intrusion, pharming or phishing attacks, — (optional) percentage of enterprises affected by ICT-related security incidents resulting in disclosure by employees of confidential data in electronic form, whether intentionally or unintentionally, — percentage of enterprises using internal ICT security facilities or procedures: strong-password user authentication, — percentage of enterprises using internal ICT security facilities or procedures: user identification and authentication via hardware tokens, e.g. smart cards, — (optional) percentage of enterprises using internal ICT security facilities or procedures: user identification and authentication via biometric methods, — percentage of enterprises using internal ICT security facilities or procedures: offsite data backup, — percentage of enterprises using internal ICT security facilities or procedures: logging activities for analysis of security incidents. Characteristics to be collected for enterprises that use computers and have a formally defined ICT security policy: — addressed risk in ICT security policy: destruction or corruption of data due to attack or unexpected incident, — addressed risk in ICT security policy: disclosure of confidential data due to intrusion, pharming or phishing attacks or by accident, — addressed risk in ICT security policy: unavailability of ICT services due to attack from outside (e.g. denial-of-service attack). ICT investment and expenditure Characteristics to be collected for all enterprises: — (optional) purchases of IT goods (computers and peripheral equipment) and communication goods (equipment), — (optional) share of purchased IT goods (computers and peripheral equipment) and communication goods (equipment) included in the balance sheet (investment), — (optional) purchases of other ICT goods (consumer electronic equipment, miscellaneous ICT components and goods, manufacturing services for ICT equipment), — (optional) share of purchased other ICT goods (consumer electronic equipment, miscellaneous ICT components and goods, manufacturing services for ICT equipment) included in the balance sheet (investment), — (optional) purchases of software, pre-packaged and customised (business and productivity software and licensing services), — (optional) share of purchased software, pre-packaged and customised (business and productivity software and licensing services) included in the balance sheet (investment), — (optional) total cost for creation of own-account software, — (optional) share of total cost for creation of own-account software included in the balance sheet (investment), — (optional) purchases of information technology consultancy and services, telecommunication services and other ICT services, — (optional) share of purchased information technology consultancy and services, telecommunication services and other ICT services included in the balance sheet (investment), — (optional) purchases of operating and financial leasing or rental services for ICT equipment, — (optional) share of purchased financial leasing services in all leasing and rental services for ICT equipment included in the balance sheet (investment). (c) The following enterprise background characteristics are to be collected or obtained from alternative sources: Characteristics to be collected for all enterprises: — main economic activity of the enterprise, in the previous calendar year, — average number of persons employed, in the previous calendar year, — (optional) time needed to complete the questionnaire (in minutes). Characteristics to be collected or obtained from alternative sources for all enterprises for the subject ICT investment and expenditure: — (optional) total purchases of goods and services (in value terms, excluding VAT), in the previous calendar year, — (optional) total turnover (in value terms, excluding VAT), in the previous calendar year, — (optional) total investment (in value terms, excluding VAT), in the previous calendar year. Characteristics to be collected for enterprises not classified in Section K of NACE Rev. 2: — total purchases of goods and services (in value terms, excluding VAT), in the previous calendar year, — total turnover (in value terms, excluding VAT), in the previous calendar year. 2. COVERAGE The characteristics specified in heading 1(b) and 1(c) of this Annex are to be collected and obtained for enterprises classified in the following economic activities, for the following enterprise sizes and with the following geographic scope. (a) Economic activity: enterprises classified in the following categories of NACE Rev. 2: NACE category Description Section C ‘Manufacturing’ Section D, E ‘Electricity, gas and steam, water supply, sewerage and waste management’ Section F ‘Construction’ Section G ‘Wholesale and retail trade; repair of motor vehicles and motorcycles’ Section H ‘Transport and storage’ Section I ‘Accommodation and food service activities’ Section J ‘Information and communication’ Classes 64.19, 64.92, 66.12 and 66.19 Groups 65.1 and 65.2 ‘Financial and insurance activities’ Section L ‘Real estate activities’ Divisions 69-74 ‘Professional, scientific and technical activities’ Section N ‘Administrative and support activities’ Group 95.1 ‘Repair of computers and communication equipment’ (b) Enterprise size: enterprises with 10 or more persons employed. Enterprises with less than 10 persons employed are to be covered optionally. (c) Geographic scope: enterprises located in any part of the territory of the Member State. 3. REFERENCE PERIODS The reference period is the year 2009 for the characteristics referring to the previous calendar year. The reference period is January 2010 for the other characteristics. 4. BREAKDOWNS For the subjects and their characteristics listed in heading 1(b) of this Annex, the following background characteristics are to be provided. (a) Economic activity breakdown: according to the following NACE Rev. 2 aggregates: NACE Rev. 2 aggregation for possible calculation of national aggregates 10-18 19-23 24-25 26-33 35-39 41-43 45-47 49-53 55 58-63 64.19 + 64.92 + 65.1 + 65.2 + 66.12 + 66.19 68 69-74 77-82 26.1-26.4, 26.8, 46.5, 58.2, 61, 62.01, 62.02, 62.09, 63.1, 95.1 NACE Rev. 2 aggregation for possible calculation of European aggregates 10-12 13-15 16-18 26 27-28 29-30 31-33 45 46 47 55-56 58-60 61 62-63 64.19 + 64.92 65.1 + 65.2 66.12 + 66.19 77-78 + 80-82 79 95.1 (b) Size class breakdown: data are to be broken down by the following size classes by number of persons employed. Size class 10 or more persons employed 10 to 49 persons employed 50 to 249 persons employed 250 or more persons employed Where covered, the following breakdown is to be applied to enterprises with less than 10 persons employed. (The characteristics are to be provided for size classes ‘Less than 5 persons employed’ and ‘5 to 9 persons employed’ optionally.) Size class Less than 10 persons employed Less than 5 persons employed (optional) 5 to 9 persons employed (optional) 5. PERIODICITY The data are to be provided once for the year 2010. 6. DEADLINES (a) The aggregate data referred to in Article 6 of Regulation (EC) No 808/2004, where necessary flagged for confidentiality or unreliability, must be forwarded to Eurostat before 5 October 2010 or, for aggregate data on the subject ‘ICT investment and expenditure’, before 30 June 2011. By that date, the dataset has to be finalised, validated and accepted. The tabulated, computer-readable transmission format must follow the instructions provided by Eurostat. (b) The metadata referred to in Article 6 of Regulation (EC) No 808/2004 must be forwarded to Eurostat before 31 May 2010. The metadata must follow the report template provided by Eurostat. (c) The quality report referred to in Article 7(4) of Regulation (EC) No 808/2004 must be forwarded to Eurostat by 5 November 2010 or, for the subject ‘ICT investment and expenditure’, before 31 July 2011. The quality report must follow the report template provided by Eurostat.