Articles 15 and 16 of Directive 2014/40/EU on the approximation of the laws, regulations and administrative provisions of the Member States of the European Union relating to the manufacture, presentation and sale of tobacco products and related products and repealing Directive 2001/37/EC, concern the establishment of a pan-European traceability system and the security features of tobacco products, to address the issue of illegal trade.

Directive 2014/40/EU has been transposed into the national law of the Republic of Cyprus with Health Protection (Tobacco Control) Law 24(I)/2017. In accordance with Regulations 17(12) and 18(4) of the 2017 Health Protection (Tobacco Control) Regulations, P.I. 84/2017, the Director of the Department of Customs and Excise of the Republic of Cyprus is the competent authority for the implementation of these provisions.

In order to determine the technical details required for the full functioning of the traceability system and the security features of tobacco products, the European Commission has adopted Delegated Regulation (EU) 2018/573, Implementing Regulation (EU) 2018/574 and Implementing Decision (EU) 2018/576, published in the Official Journal of the European Union on 16/4/2018.

In the framework of the traceability system:

• All tobacco product packages have a unique identifier.
• The relevant economic operators (manufacturers, importers, wholesalers, distributors) involved in the tobacco trade, record in the system the movements of these packages throughout the supply chain.
• The competent authorities of the EU Member States and the European Commission have access to the data for law enforcement purposes.

In this way, it is possible to track and trace the movement of legitimate tobacco products so that authorities can identify when a product is diverted to the illegal market.

Under the security feature system, all packages of tobacco products units placed on the EU market carry a security feature consisting of visible and invisible data, allowing the competent authorities to verify their authenticity.

Traceability and security features were implemented on 20 May 2019 for cigarettes and roll your own tobacco, and from the 20 May 2024 will be implemented for all other tobacco products.

Secondary Data Storage Provider

Commission Implementing Regulation (EU) 2018/574 requires the Commission to appoint, from amongst the approved providers of primary repositories, a provider tasked with operating the secondary repository.

On 21 December 2018, the Commission appointed 'Dentsu Aegis Network Switzerland AG' as provider to operate the secondary repository.

The provider operating the secondary repository established a list of specifications required for the data exchange with the secondary repository and the router, and a common data dictionary which shall be based on the information listed in Annex II to Implementing Regulation (EU) 2018/574.

The specification necessary for economic operators to exchange data with the router ana the common data dictionary are available here.

Competent ID Issuers

Pursuant to Article 3(1) of Commission Implementing Regulation (EU) 2018/574, each Member State shall appoint an entity (the ID issuer) responsible for generating and issuing the unique identifiers that the tobacco product packages have to bear. The ID Issuer of the Republic of Cyprus is the General Secretariat of Information Systems for Public Administration, Ministry of Digital Governance of Hellenic Republic.

The full list with the Competent Authorities and the ID Issuers of the EU Members States, published by the European Commission can be found here.

Article 4 of Commission Implementing Regulation (EU) 2018/574 stipulates the competence rules for generating and issuing unique identifiers.

It should be noted that the Republic of Cyprus applies the derogation of the second subparagraph of Article 4(2) of the abovementioned Implementing Regulation, based on which the ID Issuer competent to issue of unique identifiers for the tobacco products placed on its market, is its own ID Issuer.

See the information on all the EU Member States’ application of the second subparagraph of Article 4(1) here.

Articles 14, 16 and 18 of Commission Implementing Regulation (EU) 2018/574 further specify to which ID issuer(s) the economic operators (including the operators of first retail outlets) shall apply to obtain an economic operator identifier code, a facility identifier code and a machine identifier code, respectively.

For the Republic of Cyprus, the unique identifier codes for the economic operators (including the operators of first retail outlets) are issued by the General Secretariat of Information Systems for Public Administration, Ministry of Digital Governance of Hellenic Republic. The application and issue of the codes is done without any cost through the relevant portal of the ID Issuer.

The link to the portal is this, where you can also find answers to frequent questions.

Information on the procedure can be found here.