ITSA Briefs EU Government on Flaws in Tobacco Track and Trace Legislation
On 26 September, the International Tax Stamp Association (ITSA) called a meeting in Brussels with MEPs, EU member states, DG SANTE, tobacco control groups, the WCO and EU state printers to share its concerns over the implementation of the traceability and security feature requirements of the EU Tobacco Products Directive (TPD).
ITSA believes the three draft implementing acts (for traceability, security features and data storage):
- Give no guarantee of independence from the tobacco industry;
- Do not provide for strong authentication tools to counter illicit trade;
- Do not allow for a completely interoperable track and trace system based on open standards.
ITSA believes it is crucial that EU officials and other stakeholders are made fully aware of these failings and loopholes, hence the reason for calling the meeting. During the meeting, ITSA also set out recommendations as to how the drafts could be changed to comply with both the TPD and WHO Framework Convention on Tobacco Control (FCTC).
Some of ITSA’s main concerns and recommendations (which were subsequently submitted to DG SANTE as a response to its public consultation) are summarised as follows:
The draft allows producers to print the unique identifier (UID) for track and trace onto the product, using an electronic file received from an independent issuer. Although the UID itself will be genuine, if producers are free to print it, there is nothing to stop them from printing the same UID multiple times. Producers are therefore given a window of possible manipulation of the UID, which cannot be acceptable.
Producers are also required to verify the UID themselves, but the verification system cannot detect if a single UID has been printed multiple times (given that the non-compliant producer will only record one of the printed UIDs in the system).
Apart from failing to provide a guarantee of independence, the involvement of producers in printing and verifying the UID also fails to comply with the WHO FCTC and its Protocol, which state that member states may not delegate duties assigned to them to the tobacco industry and that interaction with this industry must be kept to the strict minimum.
Therefore, ITSA recommends that the UID is only supplied to the producer as a pre-printed, secured label, such as a tax stamp, which the producer registers on the production line before applying to the product. The UID would thus be quality-controlled and authentic and the risk of duplicates would be eliminated.
ITSA’s concern is that the UID described in the draft is essentially a proprietary code in terms of its required content, even if the type of code used matches ISO standards.
This means that to ensure EU-wide interoperability, all member states would need to use the same proprietary encryption method. This contradicts other facets of the draft, and is also anti-competitive.
ITSA contends that member states should have the right to select their own solution while ensuring FCTC compliance and interoperability. To guarantee such interoperability, the UID should follow international standards, in both content and form.
ITSA is concerned that traceability is being viewed as a separate matter from security features, without due attention given to the security needed to protect the UID itself.
For any secure traceability solution to work, the physical/digital combination is essential. If unsecured codes are used in isolation, without integration into visible and covert security elements, this opens the door to valid codes being cloned onto unauthorised products – with nobody any the wiser, since the codes may look exactly the same.
To avoid this risk, UIDs should be equipped with physical security features. Alternatively – and in ITSA’s view the best method – the UID can be combined with the security features required for product authentication, on the same label or tax stamp.
It is also important to note that the latest draft of the new ISO standard for tax stamps (22382) states: ‘Standalone codes not associated with authentication features or not protected against copying or replication cannot provide authentication’.
Inadequate independence of security features
A key concern with the draft act on security features is that only one out of the five required features must be provided by an independent third party. Does this mean that the other four can be provided by the producers themselves, under their control? ITSA strongly questions the premise that this represents an independent solution and does not believe that the integrity of the solution can be assured if this is the case.
In ITSA’s view it is critical to the security of the solution that all five authentication elements be provided by an independent third party, and defined by member states rather than producers.
Lack of harmonisation
Another concern is that the draft is not prescriptive enough to ensure a harmonised framework of EU-wide security features. It merely requires that each member state communicates to producers the types of authentication elements allowed, and that these include at least the 12 elements listed in an annex to the draft.
This implies that as long as member states have ‘communicated’ the allowed elements, producers can select their own features. This will lead to a patchwork situation where different brands in different states carry different authentication elements. This is not a harmonised solution and undermines the ability of member states to carry out their enforcement duties.
It is ITSA’s view that member states should be free to choose approved security features, as is the case with travel documents across the world.
Incomplete and ineffective features
The draft lists a set of allowed features that ignore some proven technologies, but include some ineffective ones:
Incomplete, because nowhere are holograms mentioned on the list. This omission is difficult to understand considering that holograms are a key high-security technology already used on tax stamps in seven member states;
Ineffective, because elements such as watermarks (which are also on the list) are only effective on items such as banknotes which allow the light to pass through them.
Failure to account for proven expertise
The drafting process constitutes a breach to the WHO Protocol, which calls for parties to take into account their own specific needs and available best practice. The EU, as Party to the Protocol, should have sought to understand the specifics of tax stamps, and the reasons why 23 out of 28 member states use them. It could have visited some of the production lines around the world – qualified as best international practices by the WHO – where tax stamps are used as traceability vehicles.