ALLEXIS - ID ISSUER FOR SWEDEN 1 st meeting with tobacco industry - - PowerPoint PPT Presentation

ALLEXIS - ID ISSUER FOR SWEDEN

1st meeting with tobacco industry

AGENDA

• Directive 2014/40/EU of the European Parliament and of the Council of

3 April 2014

• n the approximation of the laws, regulations and administrative provisions of the Member States concerning the

manufacture, presentation and sale of tobacco and related products and repealing Directive 2001/37/EC

• Commission Implementing Regulation (EU) 2018/574 of 15 December 2017
• n technical standards for the establishment and operation of a traceability system for tobacco products (Text with

EEA relevance. )

• Commission Delegated Regulation (EU) 2018/573 of 15 December 2017
• n key elements of data storage contracts to be concluded as part of a traceability system for tobacco products

(Text with EEA relevance. )

• Commission Implementing Decision (EU) 2018/576 of 15 December 2017
• n technical standards for security features applied to tobacco products (notified under document C(2017) 8435)

(Text with EEA relevance. )

• Commission Implementing Regulation (EU) 2018/1602 of 11 October 2018

amending Annex I to Council Regulation (EEC) No 2658/87 on the tariff and statistical nomenclature and on the Common Customs Tariff

LEGISLATION

TRACEABILITY SYSTEM FOR TOBACCO PRODUCTS

ID ISSUER ROLES & RESPONSIBILITIES

• Control over unique identifiers and product codes

Article 8 of Implementing Regulation

• Issuing unit level UIs

Article 9 of Implementing Regulation

• Issuing aggregated level UIs

Article13 of Implementing Regulation

• Registration of economic operators, facilities and machines

Article 15, 17, 19 of Implementing Regulation

• Establishing offline flat-files

Article 20 of Implementing Regulation

• Security protocols and connectivity rules for communications

between ID Issuer and Economic Operators

Article 36 of Implementing Regulation

REGISTRATION OF ECONOMIC OPERATORS

Collaboration Registration of UIs

ID Issuer Economic Operator Receipt

• f the

request Request Generation of EO identifier code Creation of account End Decline information received End End Need for registration Storing of request Validation of rq information Was request approved? Decline information Return rq result, EO ID and confirm. code Acceptance information, EOID and code received Contract signed? Contract for signature Send contract for signature to EO End Account update information Contract for signature received Confirm the need for contract Sign contract Signed contract received Signed contract Enable generation

• f UIs for EO

Account update information received Account update information End Contract to request UIs needed? End Request for registration

Yes No No Yes Yes No

REGISTRATION OF ECONOMIC OPERATORS

Collaboration Registration of first retail outlet ID Issuer Economic Operator Receipt of the request Request Generation of EO identifier code Request for registration for first retail outlet (GUI/API) Inform first retail outlet about registration End Decline information received End Need for registration Storing of request Validation of request information Was request approved? Decline information for EO Return of request result, EO ID and user groups Acceptance information, EOID and user groups End End Creation of user groups with roles for EO No Yes

REGISTRATION OF ECONOMIC OPERATORS

INTEGRATION

INTE INTEGRA GRATIO TION N INTE INTERF RFACES CES

• Built in accordance with Data dictionary and Interface specification published by provider of

secondary repository.

• We will use OAUTH2 authentication.
• We presume that systems of EOs will expose interfaces for delivery of generated codes and UIs,

implemented also according to Data dictionary and Interface specification published by provider of secondary repository, with OAUTH2 authentication.

SECURITY PROTOCOLS AND CONNECTIVITY RULES

Secu Security pr rity prot

• toc
• cols and
• ls and co

conn nnec ectivi tivity r ty rules ules for

• r co

commun mmunica ication tions s be betw twee een n ID ID issu issuer r and economic mic operato tors

• For the purpose of authentication and authorisation OAUTH2 protocol will be used. As the solution

will be integrated with other information systems, the communication will use encrypted protocols

• nly.
• Authentication and authorisation will be mandatory for end-user activities and integration purposes

(APIs) as well.

• The proposed solution will be compliant with GDPR in all areas: process setup, software capabilities

and infrastructure. Access to and processing of personal data will be available only to authenticated and authorised users.

• From the perspective of infrastructure protection, physical access to the data centre will be restricted

to authorised users only and all activities will be logged using logging mechanisms at the operating system level.

STRUCTURE OF UNIT LEVEL UI CODE

Feature: Code length

Code length of 26 characters including time stamp.

Feature: Algorithm used

The algorithm guarantees uniqueness of each number and difficulty to predict it with the required probability.

Feature: One lookup table

One lookup table minimises length of product code.

• ID Issuer generates unit level UIs according to Article 9 of Implementing Regulation.

STRUCTURE OF AGGREGATED LEVEL UI CODE

Feature: Code length

Code length of 31 characters including time stamp.

Feature: Algorithm used

The algorithm guarantees uniqueness of each number and difficulty to predict it with the required probability.

• Aggregated-level UIs can either be requested from the ID issuer, or self-generated by the

economic operator, in accordance with ISO/IEC 15459-1:2014 or ISO/IEC 15459-4:2014 (Art. 10).

• ID Issuer generates unit level UIs according to Article 13 of Implementing Regulation.
• There are two separate sequences for serial numbers, one for unit level UI and one for

aggregated level UI.

GENERATION OF UNIT LEVEL UIS

Business Process Generation of UIs

ID Issuer Economic Operator Secondary repository Receipt

• f the

request Request UI generation Info for SR Electronic UI (GUI/API) Transmission of generated UIs Updated info for SR Need for UIs Request for UI (GUI/API) Recall request for UIs Recall received End Recall the request The end of the next business day End UIs received End Recall request Expiration of deadline for recall

GENERATION OF UNIT LEVEL UIS

TIMELINE OF ID ISSUER PROJECT

INFORMATION PORTAL

https://idissuer.se

CUSTOMER SUPPORT - JIRA

฀ Available to you from 9:00 -17:00 ฀ Up to 15 consecutive calls ฀ Issues discussed can be projected to Jira ฀ Callback option available

CALL CENTER

IMAGINE ALL THE POSSIBILITIES IF YOU WATCH YOUR PLAN UNVEIL FROM OUTER SPACE. THAT IS HOW WE WORK.

Phone E-mail Web Slovak Republic Allexis s. r. o. Stare Grunty 1/B 841 04 Bratislava +421 2 33 00 06 11 information@allexis.com allexis.com Czech Republic ALLEXIS GROUP a.s. Na Strži 1702/65 140 00 Prague Malta Allexis Assets Ltd Macerata St. 17 Floriana