Article 25 General characteristics of the data repositoryF15

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

it shall allow for electronic identification and authentication of tobacco products, at unit packet and aggregation level, in accordance with the requirements set out in this Regulation;

it shall allow for automatic deactivation of unique identifiers in accordance with the rules set out in Article 5;

it shall ensure electronic receipt and storing of information recorded and sent to the F3data repository by economic operators and F4the ID issuer, in accordance with the requirements of this Regulation;

it shall ensure storage of data for a minimum period of five years as of the moment the data are uploaded into the F5data repository;

it shall allow for automatic status messaging to economic operators, and to F6HMRC as requested, such as in the event of success, error or changes related to reporting activities, in accordance with the requirements of this Regulation;

it shall allow for automatic validation of messages received from economic operators, including refusal of incorrect or incomplete messages, in particular reporting activities related to non-registered or duplicated unique identifiers, whereby the F7data repository shall store the information concerning any refused message;

it shall ensure messaging between all of its components which shall take place instantaneously, in accordance with the requirements of this Regulation, in particular the overall response time of the F8data repository in sending acknowledgment messages, not considering the speed of the internet connection of the end user, which shall be no more than 60 seconds;

it shall ensure continuous availability of all components and services with a monthly uptime of at least 99,5 % and sufficient back-up mechanisms in place;

it shall be guarded by security procedures and systems ensuring that access to the F9data repository and download of the data stored therein is only granted to persons authorised according to this Regulation;

it must be accessible by HMRC. Administrators designated by the Commissioners must be granted access rights enabling them to create, manage, and withdraw user access rights for the data repository. Administrators designated by the Commissioners must be able to grant subsequent access rights to other users under their responsibility;

it shall enable F11HMRC to carry out downloads of full and selected sets of data stored in F12the data repository;

it shall maintain a complete record (‘audit trail’) of all operations concerning the stored data of the users performing those operations and of the nature of these operations, including the history of users access. The audit trail shall be created when the data is uploaded for the first time and, notwithstanding any additional national requirements, be maintained until at least five years after.