EN Official Journal of the European Union L 96/57

COMMISSION IMPLEMENTING DECISION (EU) 2018/576

of 15 December 2017

on technical standards for security features applied to tobacco products

(notified under document C(2017) 8435)

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to Directive 2014/40/EU of the European Parliament and of the Council of 3 April 2014 on the approximation of the laws, regulations and administrative provisions of the Member States concerning the manufacture, presentation and sale of tobacco and related products and repealing Directive 2001/37/EC (1), and in particular Article 16(2) thereof,

Whereas:

(1) Directive 2014/40/EU provides that all unit packets of tobacco products placed on the market are to carry a tamper proof security feature, composed of visible and invisible elements, for the purpose of facilitating the verification of whether or not tobacco products are authentic. Technical standards for a system of security features should be laid down.

(2) The security features along with the system for ensuring the traceability of tobacco products, provided for in Article 15 of Directive 2014/40/EU and established in Commission Implementing Regulation (EU) 2018/574 (2), should allow for monitoring and more effective enforcement of the compliance of tobacco products with Directive 2014/40/EU.

(3) Common rules on security feature standards in the Union are essential as divergent and insufficiently precise national requirements are likely to undermine efforts to improve compliance of tobacco products with Union tobacco products regulation. A more harmonised framework for security features across Member States should also facilitate the functioning of the internal market of legal tobacco products.

(4) The technical standards for security features should give due regard to the high degree of innovation that exists in this area, while enabling competent authorities of Member States to verify the authenticity of tobacco products in an effective manner. Each Member State should be able to define the combination or combinations of authentication elements that are to be used to develop security features that are applied to tobacco products manufactured on or imported into its territory. The combination or combinations used should include visible and invisible elements. According to international standards, invisible elements, which are not directly perceptible by human senses, may further be defined by reference to the sophistication of equipment necessary for the verification of their authenticity. In order to maximise the robustness of the features, it is appropriate to require the use of at least one invisible element the verification of which requires the use of purpose built tools or professional laboratory equipment. The inclusion of a variety of different types of authentication elements into a security feature should ensure the necessary balance between flexibility and a high level of security. This should also enable Member States to take into account new innovative solutions, capable of further bolstering the effectiveness of security features.

(5) The combination of different authentication elements should be required as an important step in guaranteeing that the integrity of the final security feature applied to a tobacco product is well protected.

(6) The importance of ensuring the robustness of a system for security features is recognised by internationally recognised standards (3). To this end, additional safeguards should be put in place, which shield security features and their different authentication elements from internal and external threats to the greatest extent possible. It should therefore be required that at least one authentication element in a security feature is provided by an independent third party solution provider, thereby reducing the potential for attacks perpetrated by persons or entities that are directly or indirectly connected with the producer or originator of authentication elements used to develop the security feature. In addition, in order to ensure the continuing respect of the requirement for independence that is critical for ensuring and maintaining the integrity of security features across the Union, the procedures for monitoring compliance with the independence criteria set out in this Decision should undergo periodic review by the Commission. Conclusions of the review should be published by the Commission and form part of the report on the application of Directive 2014/40/EU provided for under Article 28 of that Directive.

(7) Several Member States require tax stamps or national identification marks for fiscal purposes. Those Member States should be free to allow that their stamps or marks are used as the security feature subject to the requirements of Article 16 of Directive 2014/40/EU and of this Decision. In order to alleviate any unnecessary economic burden, Member States whose tax stamps or national identification marks do not comply with one or more of the requirements of Article 16 of Directive 2014/40/EU and of this Decision should be allowed to use their tax stamps or national identification marks as a part of the security feature. In such cases, Member States should ensure that manufacturers and importers of tobacco products are informed of the additional authentication elements necessary to develop a security feature that is compliant with all legislative requirements.

(8) In order to ensure the integrity of security features and to protect it from external attack, they should be applied either by affixing, printing or a combination of both, in a manner that protects them from being replaced, reused or modified in any way. In addition, security features should allow for the identification and verification of the authenticity of an individual unit packet of tobacco product for the entire time the tobacco product is placed on the market.

(9) In order to allow for the verification of the authenticity of a tobacco product and thereby stepping up the fight against illicit trade of tobacco products in the Union, Member States and the Commission should, upon request, be provided with sample products that may be used as a reference for the purposes of laboratory analysis. Additionally, in order to enable competent authorities of one Member State to verify the authenticity of a tobacco product destined for the national market of another Member State, Member States should assist each other in sharing the reference products obtained, as well as providing knowledge and expertise available insofar as this is possible.

(10) The measures provided for in this Decision are in accordance with the opinion of the Committee referred to in Article 25 of Directive 2014/40/EU,

HAS ADOPTED THIS DECISION:

Article 1

Subject matter

This Decision lays down technical standards for security features applied to unit packets of tobacco products placed on the Union market.

Article 2

Definitions

For the purposes of this Decision, in addition to the definitions laid down in Article 2 of Directive 2014/40/EU, the following definitions shall apply:

(a) ‘authentication element’ means an element of a security feature;

(b) ‘overt’ means directly perceptible by one or more of the human senses without recourse to external devices. The ‘overt’ category of authentication solutions referred to in ISO 12931:2012 shall be presumed to meet this definition;

(c) ‘semi-covert’ means not directly perceptible by the human senses but detectable by those senses through the use of external devices, such as a UV torch or a special pen or marker, which do not require expert knowledge or specialist training. The ‘covert’ category of authentication solutions authenticated with off-the-shelf tools referred to in ISO 12931:2012 shall be presumed to meet this definition;

(d) ‘covert’ means not directly perceptible by the human senses and detectable only through the use of purpose built tools or professional laboratory equipment. The ‘covert’ categories of authentication solutions requiring purpose built tools and forensic analysis referred to in ISO 12931:2012 shall be presumed to meet this definition.

Article 3

Security feature

1. Member States shall require security features to be composed of no less than five types of authentication elements, of which at least:

(a) one is overt;

(b) one is semi-covert;

(c) one is covert.

2. Member States shall require at least one of the authentication elements, referred to in paragraph 1, to be provided by an independent third-party provider meeting the requirements laid down in Article 8.

3. Each Member State shall communicate to manufacturers and importers of tobacco products the combination or combinations of authentication elements that are to be used in security features applied to unit packets of tobacco products placed on its market.

The authentication elements referred to in the first subparagraph may include any of the overt, semi-covert and covert types of authentication elements set out in the Annex.

4. The communication referred to in paragraph 3 shall take place by 20 September 2018 at the latest. Any subsequent changes to the combination or combinations of authentication elements shall be communicated by Member States to manufacturers and importers of tobacco products at least 6 months prior to the date when the changes are intended to take effect.

Article 4

Use of tax stamps as security feature

1. Member States allowing tax stamps or national identification marks for fiscal purposes to be used to develop security features shall ensure that the final security features comply with the requirements of Article 3 of this Decision and Article 16 of Directive 2014/40/EU.

2. Where a tax stamp or national identification mark for fiscal purposes intended for use as a security feature does not comply with one or more of the requirements referred to in paragraph 1, it shall only be used as a part of the security feature. In such cases, Member States shall ensure that manufacturers and importers of tobacco products are informed of the additional types of authentication elements required to develop a compliant security feature.

3. The information referred to in paragraph 2 shall be made available to manufacturers and importers of tobacco products by 20 September 2018 at the latest. Any subsequent information related to changes to the tax stamp or national identification mark for fiscal purposes intended for use as a security feature shall be communicated to manufacturers and importers of tobacco products at least 6 months prior to the date when the changes are intended to take effect, provided this information is necessary for them to develop a compliant security feature.

Article 5

Applying security features to unit packets

1. Member States shall require security features to be applied to unit packets of tobacco products using any of the following methods:

(a) affixing;

(b) printing;

(c) combination of affixing and printing.

2. Security features shall be applied to unit packets of tobacco products in a manner that:

(a) allows for the identification and verification of the authenticity of an individual unit packet of tobacco product for the entire time the tobacco product is placed on the market; and

(b) protects them from being replaced, reused or modified in any way.

Article 6

Integrity of security features

1. Member States may decide, at any moment, to implement or withdraw schemes for the rotation of security features.

2. If a Member State has reasons to believe that the integrity of any authentication element of a security feature currently in use on their market is compromised, they shall require that the security feature concerned be replaced or modified. If a Member State detects a compromised security feature, it shall inform the manufacturers and importers and security feature providers concerned within 5 working days thereof.

3. Member States may lay down formal guidelines or requirements on the security of production and distribution procedures, such as those relating to the use of secure equipment and other components, audits, monitoring tools for production quantities, and secure shipping, in order to avert, deter, identify and mitigate the unlawful production, distribution or theft of security features and the authentication elements of which they are composed.

Article 7

Verification of authenticity of tobacco products

1. Member States shall ensure that they possess the means necessary to analyse each combination of authentication elements that they permit to be used to develop security features, in accordance with Articles 3 and 4 of this Decision, for the purposes of determining whether or not a unit packet of a tobacco product is authentic. The analysis should be carried out in line with internationally recognised performance criteria and evaluation methodology, such as those laid down in ISO 12931:2012.

2. Member States shall require manufacturers and importers of tobacco products located on their territory to provide, upon written request, samples of tobacco products currently placed on the market. The samples shall be provided in unit packet format and include the applied security feature. Member States shall, upon request, make available to the Commission the samples of tobacco products received.

3. Member States shall, upon request, assist each other in the verification of the authenticity of a tobacco product destined for the national market of another Member State, including by sharing any samples obtained pursuant to paragraph 2.

Article 8

Independence of authentication element providers

1. For the purpose of Article 3(2), a provider of authentication elements, as well as, where applicable, its subcontractors, shall be considered independent, if the following criteria are met:

(a) independence from the tobacco industry in terms of legal form, organisation and decision making. In particular it shall be assessed whether the undertaking or the group of undertakings is not under the direct or indirect control of the tobacco industry, including a minority shareholding;

(b) independence from the tobacco industry in financial terms, which will be presumed if, before assuming its functions, the undertaking or the group of undertakings generates less than 10 % of its annual worldwide turnover, excluding VAT and any other indirect taxes, from goods and services supplied to the tobacco sector over the past 2 calendar years, as may be determined on the basis of the most recent approved accounts. For each subsequent calendar year, the annual worldwide turnover, excluding VAT and any other indirect taxes, from goods and services supplied to the tobacco sector shall not exceed 20 %;

(c) absence of conflicts of interests with the tobacco industry of the persons responsible for the management of the undertaking or the group of undertakings, including members of the board of directors or any other form of governing body. In particular, they: (i) shall not have participated in company structures of the tobacco industry for the last 5 years; (ii) shall act independently from any pecuniary or non-pecuniary interest linked to the tobacco industry, including possession of stocks, participation in private pension programmes or interest held by their partners, spouses or direct relatives in the ascending or descending line.

2. Where a provider of authentication elements has recourse to sub-contractors, it shall remain responsible for ensuring compliance by those subcontractors with the independence criteria set out in paragraph 1.

3. Member States, as well as the Commission, may require providers of authentication elements, including where applicable their sub-contractors, to provide them with documents necessary to assess compliance with the criteria set out in paragraph 1. Such documents may include annual declarations of conformity with the independence criteria set out in paragraph 1. Member States and the Commission may require that the annual declarations include a full list of services provided to the tobacco industry during the last calendar year as well as individual declarations of financial independence from the tobacco industry provided by all management members of the independent provider.

4. Any change in circumstances related to the criteria referred to in paragraph 1, capable of affecting the independence of a provider of authentication elements (including, where applicable, its subcontractors), that subsist for 2 consecutive calendar years, shall be communicated without delay to the relevant Member States and to the Commission.

5. Where, information obtained in accordance with paragraph 3, or the communication referred to in paragraph 4, discloses that a provider of authentication elements (including, where applicable, its subcontractors) no longer meets the requirements laid down in paragraph 1, then within a reasonable time period and at the latest by the end of the calendar year following the calendar year in which the information or communication was received, Member States shall take all measures necessary to ensure compliance with the criteria set out in paragraph 1.

6. Providers of authentication elements shall inform without delay the relevant Member States and the Commission about any occurrences of threats or other attempts at exercising undue influence that may actually or potentially undermine their independence.

7. Public authorities or undertakings governed by public law along with their subcontractors shall be presumed independent from the tobacco industry.

8. The procedures governing the monitoring of compliance with the independence criteria set out in paragraph 1 shall be subject to periodic review by the Commission with a view to assessing their conformity with the requirements of this Decision. Conclusions of the review shall be published and form part of the report on the application of Directive 2014/40/EU provided for under Article 28 of that Directive.

Article 9

Transitional provision

1. Cigarettes and roll-your-own tobacco that were manufactured in the Union or imported into the Union before 20 May 2019 and do not carry a security feature in accordance with this Decision may remain in free circulation until 20 May 2020.

2. Tobacco products other than cigarettes and roll-your-own tobacco that were manufactured in the Union or imported into the Union before 20 May 2024 and do not carry a security feature in accordance with this Decision may remain in free circulation until 20 May 2026.

Article 10

Addressees

This Decision is addressed to the Member States.

Done at Brussels, 15 December 2017. For the Commission Vytenis ANDRIUKAITIS Member of the Commission

(1) OJ L 127, 29.4.2014, p. 1.

(2) Commission Implementing Regulation (EU) 2018/574 of 15 December 2017 on technical standards for the establishment and operation of a traceability system for tobacco products (see page 7 of this Official Journal).

(3) ISO 12931:2012 (Performance criteria for authentication solutions used to combat counterfeiting of material goods).