Document 11.2
Pages 1 and 2 were entirely deleted as they fall outside the scope of the request
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
8. ANNEX B: DETAILED MODEL CONTRACT FOR THE THIRD PARTY DATA
Commented
: Clauses to be added : IP ; Business
Continuity Plan ; Liability exemption for the Contractor in case of
STORAGE
illicit data ; Access to Data (with corresponding duties for persons
accessing to Data).
8.1. General Terms and Services
Commented
: Please add a table of content
Agreement
in the person of its legal
Commented
: The structure of the Contract should be
representative
pro tempore,
reviewed. I do not see any added value to the distinction between
between
GTC (+ annex) and STSs (also with annexes) except if the provisions
and
and the rules are different (depending on the object of the STS).
the
company
There is also a risk of inconsistency between the contractual
This Agreement is signed between
________________________
documents, with a higher level of complexity.
Recommended structure :
the company ______________________
VAT
number
- Work Order (with limited derogation to GTC – on duration ;
with
VAT
number
________________________,
liability CAP, etc.).
_____________________,
based
in
based
in
- GTC
- Annex 1 (technical + SLA)
________________________
________________________
- Annex 2 (price)
(hereinafter the: “
Contractor”) in the
(hereinafter
referred
to
as
Commented [LM4]: Wouldn't it be possible to have a more
person of its legal representative
pro
“
Manufacturer/Importer”).
simple model SLA, rather than General Terms of Service
tempore undertakes to perform with
The
Contractor
and
the
(hereinafter: “
GTS”), which include the Technical Requirements
respect to
Manufacturer/Importer
will
(hereinafter: “
TR”, Annex 1 to the GTS) together with the Special
hereinafter be referred to jointly
Terms of Service (hereinafter: “
STS”), which include the Service
the
company
as the “
Parties” or individually as
Level Agreement (hereinafter: “
SLA”, Annex A to the STS) and the
Price Conditions (hereinafter: “
PC”, Annex B to the STS)?
________________________ with VAT
a “
Party”. The GTS, the STS and
number ________________________,
the Annexes will be jointly
Commented [ET5R4]: We have reviewed this matter with our
based in ______________ (hereinafter
referred
to
below
as
the
external legal advisors and this is the most common and accepted
standard for cloud storing agreements. In comparison with other
referred
to
as
“Agreement”.
model contracts of this nature, this is the most simple that it can
“
Manufacturer/Importer”) who make
already get.
a request according to the terms and
modalities described herein.
WHEREAS
We suggest to keep this structure and discuss it with the external
expert(s) during the review.
The
Contractor
and
the
1. Introduction and definitions
Commented
: It should start with this part.
Manufacturer/Importer will hereinafter be
1. Directive 2014/40/EU on tobacco
Formatted: Justified
referred to jointly as the “
Parties” or
products (hereinafter “
Directive”) aims
Commented
: To be defined
individually as a “
Party”.
to improve the functioning of the internal
Commented
: 1.1.to 1.4. should be included in the
1.5.This Agreementese General Terms of
market for tobacco and related products,
“whereas” of the Agreement, together with a short presentation of
the Parties.
Service
(hereinafter:
“the
while ensuring a high level of health
Agreement
GTS”), which includes:
protection for European citizens. The
Directive entered into force on 19 May
Annex
1:
the
Technical
2014 and became applicable in the EU
Requirements (hereinafter: “
TR”,
Member States on 20 May 2016.
Annex 1 to the GTS) together with
the Special Terms of Service
2. Article 15 of the Directive requires that
(hereinafter:
“
STS”),
which
all economic operators involved in the
include
the
Service
Level
trade of tobacco products, from the
Agreement (hereinafter: “
SLA”,
manufacturer to the last economic
Annex A to the STS) and
operator before the first retail outlet,
Annex 2: the Price Conditions
record the entry of all unit packets into
(hereinafter: “
PC”, Annex 2B to
their possession, as well as all
the GSTS),
intermediate movements and the final
Annex 3: Definitions.Anne 3:
exit of the unit packets from their
Definitions. govern the provision
possession.
of Service that the company
3. For the purpose of hosting the data
________________________
storage facility for all relevant data
VAT
number
generated by the abovementioned
________________________,
obligation, the Directive requires that
based
in
Member
States
ensure
that
________________________
manufacturers and importers of tobacco
(hereinafter the: “
Contractor”)
products conclude data storage contracts
2017
3
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
with an independent third party. The data
(hereinafter
referred
to
as
storage facility shall be physically located
“
Manufacturer/Importer”).
on the territory of the European Union.
The
Contractor
and
the
4. The resulting data storage of the
Manufacturer/Importer will hereinafter be
Tracking and Tracing System is based on:
referred to jointly as the “
Parties” or
individually as a “
Party”. The GTS, the
i) a group of independent Primary Data
STS and the Annexes will be jointly
Commented
: The relationship (and the difference)
Storage solutions, where each Primary
referred to below as the
“Agreement”.
between Primary Data Storage solutions and Surveillance Data
Data Storage solution hosts data
Storage Solution remains unclear. I also understand that both kinds
exclusively
related
to
a
specific
56. Pursuant to Article 15(8) of the
of services could be provided by distinct providers. Should it be the
case, the duties of each of them must be very clear (as well as the
manufacturer/importer or a group of
Directive, the European Commission
liability in case of breach).
distinct manufacturer(s)/importer(s);
approves the suitability of the Agreement
Commented [everis10R9]: Indeed, both kinds of services
as a model contract to comply with the
could be provided by distinct providers. However, we are putting
ii) a central Surveillance Data Storage
Directive and to assure the Contractor’s
focus now on developing the contract between the
solution which hosts a global copy of the
independence and technical capacities.
manufacturers/importers and the provider(s) of primary data
distributed data. On this basis, the
storages.
Surveillance Data Storage solution is able
67. The present Agreement regulates the
Commented
: To be defined
to offer a comprehensive logical view of
relationship between the Parties and also
Commented
: To be included in the whereas.
all relevant data based on its local data,
enables the European Commission and
which could be further exploited for the
the competent authorities to effectively
enforcement required by the Directive.
exercise their rights pursuant to Article 15
Also, the Surveillance Data Storage
of the Directive.
solution provides a secure Repository
Router component (as defined in Annex 1
78. Unless specifically provided in the
“Technical Requirements”) to facilitate
Agreement, all terms shall have the same
that the distributors and wholesalers
meaning as defined in Article 2 of the
Commented
: For clarity purposes, I recommend to
transmitting their reports seamlessly
Directive.
include such definitions in the Agreement and to define also the
through a single point.
other terms (in annex or in the first provision).
The Parties have agreed as follows:
Commented [everis17R16]: To be included as an Annex
Agreement
1. General Scope and structure of the
Commented
: Article 1 and 2 (or 3) should be reviewed in
order to ensure that there are no redundancies, and that the scope
between
Agreement General Terms of Service
and main duties are clearly explained and presented.
(GTS) and Special Terms of Service
Commented [LM11]:
1.5.These General Terms of Service
(STS)
Wouldn't it be possible to have a more
simple model SLA, rather than General Terms of Service
(hereinafter: “
GTS”), which include the
(hereinafter: “
GTS”), which include the Technical Requirements
Technical Requirements (hereinafter:
1.1. The GTS describes the general
(hereinafter: “
TR”, Annex 1 to the GTS) together with the Special
“
TR”, Annex 1 to the GTS) together with
content of the commitments that the
Terms of Service (hereinafter: “
STS”), which include the Service
the Special Terms of Service (hereinafter:
Parties assume with regard to the supply
Level Agreement (hereinafter: “
SLA”, Annex A to the STS) and the
Price Conditions (hereinafter: “
PC”, Annex B to the STS)?
“
STS”), which include the Service Level
of Service identified in the relative STS
Agreement (hereinafter: “
SLA”, Annex A
provided. by the Contractor and further
Commented [ET12R11]: We have reviewed this matter with
to the STS) and the Price Conditions
details the specific content of the
our external legal advisors and this is the most common and
accepted standard for cloud storing agreements. In comparison with
(hereinafter: “
PC”, Annex B to the STS),
commitments
that
the
Parties
other model contracts of this nature, this is the most simple that it
govern the provision of Service that the
respectively assume.
can already get.
company ________________________
VAT
number
2.2. The STS describes the service
We suggest to keep this structure and discuss it with the external
expert(s) during the review.
________________________, based in
provided by the Contractor and further
________________________
details the specific content of the
Commented
: Please explain also the structure of the
Agreement here :
(hereinafter the: “
Contractor”) in the
commitments
that
the
Parties
-The GTS
person of its legal representative
pro
respectively assume.
-The Annexes to the GTS
tempore,
-WO?
1.2. The GTS together with the relative
Commented
: It should start with this part.
and
STS and Annexes govern the relationship
between the Parties.
Commented
: Structure to be reviewed
the
company
Commented
: Please explain what is covered by the
________________________
VAT
2.4. In case of conflict, the provisions of
“Services” (data storage, access, maintenance and support).
number ________________________,
the STS prevail over the provisions of the
Commented
:
based in ________________________
GTS.
And in case of conflict between the STS or
between terms of STS and Annex? Structure : to be moved in the
final provisions of the agreement.
2017
4
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
1.3 The Service provided by the
the
Agreement.
The
Commented
: To be defined. Object and scope of the
Contractor to the Manufacturer/Importer
Manufacturer/Importer may terminate
service should also be detailed (in a provision of the agreement) :
is described in detail in the related
the contract, under approval of the
- Primary Data Storage
Technical RequirementsSTS (hereinafter:
European Commission, if those conditions
- Surveillance Data Storage
- And for both : (i) access to Data (by whom and under which
“
Service”).
are no longer maintainedfulfilled.
requirements) ; (ii) Support and maintenance.
Unless specifically provided in the
3.4. The expertise and independence
Commented
: For clarity purposes, I recommend to
include such definitions in the Agreement and to define also the
Agreement, allcapitalised terms or
required to the Contractor are set in the
other terms (in annex or in the first provision).
expressions terms shall have the same
Delegated Acts adopted by the European
Commented [everis24R23]:
meaning as definedindicated in Annex
Commission in accordance with article
To be included as an Annex
3rticle 2 of the . Directive.
Commented [everis26R25]: The full description of the
15.12 of the Directive.
technicalities of both Data Storages is to be included in the Technical
2.
Subject
matter
for
this
3.54. The Contractor undertakes agrees
Requirements (currently under preparation)
AgreementMain
duties
and
to provide the Manufacturer/Importer
Commented
: Add provision on duty referred to in Article
warranties of the Contractor
with information on updates (as defined
15 (9)
in Annex 1 “Technical Requirements”) and
Commented
: Updates = maintenance?
2.1. The Contractor will provide the
to implement updates during the
Commented
: To be defined
Sservices as described in Annex 1
execution of the Agreement pursuant to
“Technical Requirements”. The Contractor
Commented [everis38R37]:
Annex 1 “Technical Requirements”).
To be defined in the Technical
and Manufacturer/Importer may also
Requirements document, currently under preparation.
agree on Contractor providing additional
3.65. The Contractor makes available to
Commented
: Support is not only hotline. Must be much
services and new services.
the
Manufacturer/Importer
supporta
more detailed in the SLA.
telephone and/or e-mail hotline services
Commented
: To be moved to a specific provision named
2.2. The Contractor shall develop a
for providing support, pursuant to the
“Business continuity plan”. Main duties should be included in the
business continuity plan prior to the
specifications set forth in Annex A 1
agreement.
commencement date.
“SLLA”. to the STS.
Commented
: Articles 3 and 4 should be put together.
The Contractor should warrant that the contractual and legal rules
3.
Obligations
of
Contractor,
4. Availability and performance of
are respected. A difference could also be made, when applicable,
procedures for the implementation,
between obligations of result and obligations of means.
Service
maintenance and support of the
Commented
: Structure : should be included under 3
Service.
3.74.1. The Contractor maintains the
(Obligations)
operability, availability and performance
Commented [LM30]: The first thing to do is to define the
3.1. The Contractor warrants that the The
of the Service for the duration of this
service covered by this contract
Service ishall bes offered provided in
Agreement in accordance with the
Commented [ET31R30]: We rather prefer to describe it in the
compliance with the present Agreement
requirements set forth in Annex 1
Special Terms of Service, mainly because the service to be provided
and the relevant annexes, in particular
“Technical Requirements” and Annex A
in the surveillance data storage is not the same service to be
the technical specifications (as defined in
provided in the primary data storage. The scope and responsibilities
“SLA” to the STS.
of the service are different, and therefore specified in the STS.
Annex 1 “Technical Requirements”). It
also warrants that it and will be
3.84.2. The Contractor informs the
Commented [LM41]: Isn't this a repetition of par. 3.1?
implemented at latest by the date
Manufacturer/Importer about the service
Commented [ET42R41]: No, this paragraph specifies that that
specified in the STSthis Agreement.,
maintenance.
contractor shall not only provide the service, but also ensure its
subject to acceptance tests if so provided
operability, availability and performance of the Service.
therein.
4.323.9. The Service may be interrupted
Commented
: Does it mean that there should be an
for the performance updates and
acceptance procedure? If so, the criterions of acceptance must be ...
3.2. The Contractor warrants that, when
“
Ordinary Maintenance” (the scheduled
Commented
: Additional rules must be prescribed with
providing the Service, it shall undertakes
maintenance by the Contractor) or
regard to maintenance (corrective maintenance? Evolutive
...
to complycomply with the applicable law
“
Extraordinary
Maintenance”
Commented [everis44R43]: Developed in the SLA annex.
and the Implementing and Delegated Acts
(unplanned
maintenance
of
the
Commented
:
adopted by the European Commission
Contractor due to events beyond the
The maintenance must be a duty
(otherwise, for security reasons, the risks will be inacceptable).
pursuant to the Directive.
reasonable control of the Contractor), as
described in Annex 1 ‘SLA’. The
Commented [LM46]: Will the contractor have the right or the
3.3. The Contractor assures warrants its
obligation to carry on the maintenance?
Contractor will havehas the obright (and
independence from the tobacco industry
obligation when required) to carry out
Commented [ET47R46]: Updated
and its technical capacities with respect to
updates, patches, fix bugs, or perform
Commented
: To be defined. This point is very
the
performance
of
the
Service.
other maintenance on the Service in
important. It means indeed that the Contractor is like a trust service
...
Independence and technical capacities of
compliance with the Annex 1 “Technical
Commented [everis34R33]: The expertise and independence
the Contractor is toshall be assessed by
Requirements” and Annex A “SLA”. to the
requirements are to be defined by the EC in the delegated acts to be
...
the
European
Commission,
and
STS. It is understood that the Contractor
Commented
: It should be a warranty. What will occur,
maintained during the whole duration of
shouldn’t it be the case in the future? What are the criterions taken
...
2017
5
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
will
promptly
notify
the
Contractor will document such change
Manufacturer/Importer
of
scheduled
using the Change Request Form attached
Ordinary Maintenance. The Contractor
in Exhibit XX (Change Request Form) that
will take all reasonable efforts to forewarn
sets for the a description of the change,
the
Manufacturer/Importer
of
the rational for the change and the impact
Extraordinary
Maintenance
and
to
the change will have on the price and
minimise the inconvenience resulting
timeline for completion of the affected
from such interventions.
Service. The Manufacturer/Importer shall
4.
Improvement
of
the
not be obliged to pay for any change that
ServiceChange control procedure
has not been approved in writing and in
Commented
:
advance in accordance with this
Perhaps are there too many details. How
is it articulated with the duty to submit to the Commission for
4.1. The Manufacturer/Importer may, at
Agreement. In no event will changes be
approval?
any time, suggest or request changes,
requested
that
require
modifications, or additions to the scope of
manufacturer/importer to bear the cost of
the Service. The Contractor may also
delays, failures or rework attributable to
propose changes. Such requests shall be
the Contractor’s failure to perform in
conducted in accordance with the Change
accordance with this Agreement or that
Control procedures set forth in this article
arise from the Contractor’s delivery of
34. The Contractor shall not take any
defective or unacceptable Services.
action or implement any decision which
may have a material effect on the
have
the
right
to
request
the
Manufacturer/Importer
or
which
improvement of the Service through the
adversely affects the function or
submission to the Contractor of a new
performance of, or decreases the
STS, that has to be agreed and accepted
Commented [LM49]: Should the STS be signed by both Parties
resource efficiency below the agreed SLA,
upon the Parties.
as part of the contract? In that case it can't be unilaterally modified.
without
first
obtaining
Commented [ET50R49]: Updated
5. Duration of the Service
Manufacturer/Importer’s approval, which
Commented
: A change request procedure must be
the Manufacturer/Importer may withhold
5.1. The Service is provided for the period
included, in case of modification of the service, at the request of the
at its sole discretion.
M/I or following the suggestion of the Contractor.
determined in the STS.
Commented [everis52R51]: Change Control procedure
4.2. No purported amendment or
6.2. The duration and validity of the GTS
included
variation of this Agreement, or any
and STS are decided by the European
Commented
Indefinite or definite duration? If
provision of this Agreement, shall be
Commission pursuant to Section 20
indefinite, it is normally possible to terminated it with a reasonable
effective unless it is in writing in a form
“Amendments to GTS and STS”. This
notice period. In the present case, definite duration is probably
specified by the Manufacturer/Importer
better, in order to ensure that a minimal duration will be respected.
Agreement shall take effect on the
as set out in Exhibit XXX (Request for
effective date and shall continue and
Change Form) and duly executed by or on
remain in full force for a period of five (5)
Commented
: As it is a “model contract”, I suggest to
behalf of each of the Parties (a “Change
years (the “Term”) unless and until earlier
mention a minimal duration (and parties are free to agree on a
Order”). A Change Order can never result
terminated in accordance with this
longer period).
in a non-compliance with the Technical
Agreement.
Requirements of Annex 1.
5.2. Manufacturer/Importer shall have
4.3. The scope of the Service may be
the right to extend the Term for up to 2
subject to additions, deletions or revisions
renewal periods of 1 year each by giving
Commented
: Why is it limited?
agreed upon by the Parties. Additions,
the Contractor written notice of its
deletions or revisions that may impact the
intention to do so at least six (6) months
price or timeline for completion of the
before the end of the Term of extended
Service must be approved in advance and
term (as the case may be). All extensions
in writing by the Manufacturer/Importer.
to the Term shall be on the same terms
If and to the extent that any change does
and conditions (including charges) as set
not materially increase the costs or
out in this Agreement.
resources requirements of the Contractor,
such change will not increase the price or
6.
Confidentiality
and
timeline for completions of the affected
announcements
Service. If a change will materially
increase the price or timeline for
completion of the affected Service, the
2017
6
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
6.1. The Recipient Party shall hold all
pertaining to such and provide an affidavit
confidential
information
in
strict
to such effect.
confidence, and specifically, shall:
6.2. Unless expressly agreed otherwise,
(i) Use confidential information only for
all rights, title and interest to and in
the purposes of the performance of its
confidential information shall vest and
obligations under this Agreement;
remain in the Disclosing Party;
(ii) Restrict disclosure of or access to
6.3. Should the Recipient Party be
confidential
information
to
its
required
to
disclose
confidential
representatives,
advisors,
auditors,
information pursuant to a statute, a
members and users who need to know
regulation or the order of a court of
such for the purposes of the performance
competent jurisdiction or a public
of the Agreement, and not divulge
authority, the Recipient Party shall (a)
confidential information to any other third
immediately after gaining knowledge or
parties or give any other third party
receiving notice of such legislative,
access to confidential Information without
administrative or judicial action, notify
the Disclosing Party’s prior written
the Disclosing Party thereof in writing and
consent;
give the Disclosing Party the opportunity
to seek any legal remedies so as to
(iii) Subject any person having access to
maintain such confidential information in
confidential information for the purpose of
confidence, (b) only supply confidential
performing
this
Agreement
to
information that it is legally required to
confidentiality and non-use obligations at
disclose, and (c) take all possible
least as restrictive as the ones set out in
measure to maintain the confidentiality of
this Agreement, and make such person is
confidential information.
Commented
: Check consistency with rules applicable to
aware, prior to any disclosure or access,
access to data.
of the confidential nature of this
6.4. Neither Party shall issue any media
information. Upon request, the Recipient
release, public announcement or other
Party shall provide the Disclosing Party
disclosure relating to the existence, the
with the names of the persons having
purpose and the content of the
access to confidential information;
Agreement or use the name, trademark
or logo of the other Party without the prior
(iv) Only make such copies of confidential
written agreement of the other Party
information as are strictly necessary for
including,
without
limitation,
in
the performance of its obligations under
promotional or marketing material,
the Agreement, and not alter, modify,
provided that nothing in this article shall
dissemble, reverse engineer or decompile
restrict any disclosure to the extent
any Confidential Information;
required by a legislative, administrative
or judicial action as mentioned under
(v)
Notify
the
Disclosing
Party
article above.
immediately
upon
suspecting
or
becoming aware if any unauthorised
6.5. Confidential information shall not
disclosure, access or use of confidential
include information that the Recipient
information and take all measures
Party can prove:
necessary to prevent any (further)
unauthorised disclosed, access or use
(i) is at the time of disclosure, or
thereof;
thereafter becomes, in the public domain
without violation of this Agreement,
(vi) Upon the Disclosing Party’s request at
any time and in any event upon expiration
(ii) is lawfully obtained from a third party
or termination of the Agreement, at the
that
has
lawfully
obtained
such
Disclosing Party’s option, promptly
information; or
destroy or return the disclosing Party its
confidential information, including any
(iii) was already known by and on record
copies, notes, recordings, memoranda
at the Recipient Party prior to disclosure
and other documents and supports
by the Disclosing Party or prior to access
Commented
: Please check conformity with prohibition
by the Recipient Party; or
to modify or delete recorded data.
2017
7
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
(iv) is developed by the Recipient Party
Manufacturer/Importer’s
instructions,
completely
independently
of
any
except for an obligation imposed by law.
disclosure by the Disclosing Party or of
any access by the Recipient Party.
(ii)
unless otherwise requested by
Manufacturer/Importer, process personal
6.6. The obligations and restrictions set
data only to the extent and in such
forth in this article shall be in force for the
manner, as is necessary for the provision
term of the Agreement and shall remain
of the Services; and for no other
in effect twenty (20) years after
purposed;
expiration or termination or termination
of the Agreement for any reason
(iii)
ensure that all necessary or
whatsoever.
appropriate technical and organisational
measures
shall
be
taken
and
implemented to (a) protect the security
and confidentiality of personal data
7. Data protection and access rights
processed by it in providing the Services,
Commented
: Are there any personal data in the
and (b) protect personal data against
meaning of GDPR?
7.1. In this article, “process”, “data
unauthorised or unlawful processing of
Commented
: Clear distinction shall be made between
processor”, “data subject” and “personal
personal data and against accidental loss
confidentiality and data protection.
data” shall have the meaning given in the
or destruction of, or damage to, personal
Commented
EU Data Protection Directive 95/46/EC
Not yet compliant with Article 28 of the
data; and notably implement the security
GDPR.
and, from 25 May 2018 in compliance
measures imposed under applicable law
with Regulation UE 679/2016; and
or adopted by competent regulatory from
implementing national laws in EU Member
time to time;
States, and all applicable data protection
and privacy laws and regulations
(iv) not disclose personal data to any
(hereinafter, “Data Protection Laws”).
employee, director, agent or affiliate of
the Contractor or any third party except
7.2. The Contractor agrees to perform all
as necessary for the performance of the
Services under this Agreement, including,
Service.
without limitation, the collection, use,
processing, storage, and maintenance of
(v) take reasonable steps to ensure the
personal data, in accordance with the
reliability and integrity of any Staff who
Data Protection Laws and the terms of
have access to the personal data and, if
this article.
sensitive personal data are processed,
draft a list of the categories of persons
7.3. To the extent that any personal data
having access to such data with a
is processed under the Agreement, or if
description of their function, ensure that
the Contractor receives or has access to
they are kept by a statutory or
any personal data under or in relation to
contractual obligation to maintain the
this Agreement, then the provisions of
confidentiality of such data, and keep a
this article shall apply. To the extent the
list
of
such
persons
at
Contractor receives and/or processes
Manufacturers/Importer’s or competent
personal data under or in relation to this
regulators’ disposal;
Agreement
on
behalf
of
the
Manufacturer/Importer,
as
data
(vi) not cause or permit personal data to
processor, the Contractor shall in respect
be transferred outside the European
of such personal data:
Economic
Area
without
Manufacturer/Importer’s prior written
(i) act only on instructions and directions
consent;
Commented
:
from Manufacturer/Importer, which is the
This could be an issue with regard to the
obligation to locate data within the UE Territory. It should not be
data controller, and comply promptly with
(vii) provide at no charge such assistance
allowed, including with prior written consent.
all such instructions and directions
as
Manufacturer/Importer
may
received
from
the
reasonably require in order to the
Manufacturer/Importer, and ensure that
Manufacturer/Importer to deal with any
any person acting under its authority
request for data subject access under the
having access to personal data may only
applicable Data protection Laws, or any
process
them
upon
request, inquiry or investigation initiated
2017
8
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
by any relevant regulatory authority in
had such conditions imposed. The
Commented [LM71]: This is a repetition of section 7.1, I would
respect of personal data;
Contractor regularly monitors that such
suggest to delete it.
obligations are not breached by its
Commented [ET72R71]: This sections binds the employees
(viii) comply with all relevant provisions
personnel or other persons it retains for
and any other person related to the Contractor, we believe it is
of applicable Data Protection Laws.
the performance of activities under this
important to keep it due to the criticality of the data managed by
Agreement.
the data storage(s).
7.4.
The Contractor keeps in strict
confidence and does not disclose to any
7.4. If personal data are handled under
Commented
: Provision on “Confidentiality” must be
third party any data which it receives or
the present Agreement, the Contractor
completed (what is confidential information? Are there exceptions?
which comes to its knowledge as a result
undertakes to process them only to the
Who can access? Penalty in case of infringement, etc.).
of the performance of its obligations
extent strictly necessary to provide the
under this Agreement. Only the European
Service and in compliance with Directive
Commission, the competent authorities
95/46/EC as implemented in the relevant
and the approved external auditor
national law and, from 25 May 2018 in
Commented
How and when?
(pursuant to Section 11 “Right of audit”)
compliance with Regulation UE 679/2016;
Commented
: Not sufficient to comply with GDPR
have full access to the Contractor’s
(Contractor is acting as a processor and therefore the requirements
facilities and data stored in the
7.5. The Manufacturer/Importer retains
of Article 26 must be respected). Who is the controller? The
performance of the Service. In duly
the exclusive responsibility for damages
processor? Purpose of processing? International transfer…
justified cases the European Commission
caused by failure of the preservation of
Commented [LM64]: I would suggest to have a paragraph on
or the Member States may grant the
the confidentiality of authentication
access rights, keeping in mind that the entities that will have access
Manufacturer/Importer access to the data
credentials, including the password
to the data storage won't be party of the contract.
stored in the performance of the Service,
needed to use the Service. The Contractor
Commented [ET65R64]: Adapted
provided that commercially sensitive
is not responsible for any damage that the
information
remains
adequately
Customer may incur for the use of
Commented
: To be defined.
protected in conformity with the relevant
passwords, authentication credentials
Commented [everis67R66]: By the EC in its delegated acts
European Union and national law.
and accounts by third parties, of which
the Manufacturer/Importer is or is not
Commented [LM68]: This is already defined in the TPD, no need
7.2 The Contractor strictly observes any
aware, nor for misuse, unauthorised or
to repeat it. Please consider that this is a contract between industry
specific confidentiality and/or security
and data storage provider, therefore you should always keep in
illegal use of the account, password and
mind that it binds only the contracting parties.
obligations (as defined in Annex 1
credentials
attributable
to
the
“Technical
Requirements”).
The
Commented [ET69R68]: Even if it is already defined in the
Manufacturer/Importer or others.
TPD, we believe it is important to keep it here in order to provide
Contractor warrants that its technical and
the full picture of the access rights and the use of data.
organisational security measures are
8. Price, billing and payments
appropriate to protect data received or
We are aware that the agreement binds only the contracting parties
which comes to its knowledge under this
8.1. ITn consideration for Contractor
(manufacturers/importers and providers of data storage(s) services),
but it is also true that the TPD provides a strong legal frameworks
Agreement from accidental or unlawful
carrying
out
the
Services,
which needs to be referenced in the Agreement.
destruction or accidental loss, alteration,
Manufacturer/Importer shall pay to the
Commented
:
unauthorised disclosure or access, in
Contractor the Charges as set out in
Access right should be much more
detailed. “Parties agree that access to [please mention DATA] shall
particular where such data is transmitted
Annex 2 and on receipt of a valid invoice
be given to the EU Commission and [please mention recipient] in
over a network.
in respect of such charges.
accordance with [please mention legal provision], for the purpose of
[please mention purpose]”. In case of personal data, it must be
7.3 To ensure that confidentiality and
8.2. Payment for Services will be
compliant with the controller/processor relationship. It could serve
security is observed at all times, the
dependent on the acceptance by
as model, for consistency reasons, for the access to data that are not
personal data. It is recommended to add a specific provision on
Contractor similarly binds each of its
Manufacturer/Importer of the services.
access. Access is requested to Contractor or to the M/I?
employees and any other person it retains
Commented [LM74]: How could the manufacture responsible
for the performance of its obligations
8.3. Except for VAT, the Contractor shall
for the credential and the authentication if under the Directive they
under this Agreement to observe the
be responsible for all tax liabilities in
shall not access the data storage?
confidentiality and security obligations
respect of any amounts payable
Commented [ET75R74]: Article 15.8 TPD: “n duly justified
laid down in this Agreement. The
hereunder and hereby agrees to
cases the Commission or the Member States may grant manufacturers
Contractor shall impose on such persons
indemnify
manufacturer/importer
in
or importers access to the stored data, provided that commercially
conditions at least as stringent as those
respect of any claims with ay be made
sensitive information remains adequately protected in conformity
with the relevant Union and national law.”
laid down in this Agreement. When
against Manufacturer/Importer by the
deemed
necessary
by
the
relevant authorities in respect of tax or
Commented
: Not applicable here (except at the
beginning of the provision of the service, but I understand that the
Manufacturer/Importer
(and
the
similar charges, and any costs, interest
acceptance procedure was deleted).
European
Commission
and/or
the
and penalties which may be found due in
competent authorities, the Contractor
respect of such amounts.
provides evidence that its personnel and
the personnel of any subcontractors have
2017
9
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
8.4. All sums due to the Contractor under
Contractor ensures that the facilities
this Agreement shall be payable by
providing the Service remain on or are
Manufacturer/Importer
by
electronic
relocated to the territory of the European
bank transfer after receipt of a correct,
Union.
undisputed and properly due invoice
which shall state, as a minimum:
9.2. Changes in the physical location of
the Contractor’s facilities during the term
(i) a short description of the relevant
of the Agreement may take place only
Services;
after the written approval of the
Manufacturer/Importer.
(ii) the period to which the invoice
relates;
9.3. The Contractor may not subcontract
Commented
: Why not? Also under its responsibility, and
part of the Service to third parties.
with prior written agreement of the M/I. Are there providers on the
(iii)
Contractor’s bank account for
market that do not have any subcontractor?
payment; and
Commented [everis85R84]: Requested by DG SANTE
(iv) all charges and applicable taxes.
9.3. In case of breach of the contract the
Commented [LM86]: I don't think it is beneficial to allow for a
Manufacturer/Importer may terminate
subcontract of any of the activities which are part of the service. In
addition the Directive doesn't allow the Commission to approve the
8.5. If Manufacturer/Importer has a bona
the Agreement.
subcontractor.
fide dispute in relation to the whole or any
Commented [ET87R86]:
parts of an invoice submitted by the
10. Ownership of data
Updated.
Contractor, Manufacturer/Importer may
Commented
To be included in Article 17 : Termination
withhold payment of the amount in
10.1. The Contractor processes data
Commented
: Ownership of data is a very complex and
dispute.
supplied by the Manufacturer/Importer
controversial question and this model contract is not the place to
only for the purposes of this Agreement
solve it. Actually, it depends upon the legal framework used to
8.6. Contractor shall continue to perform
pursuant to the Directive and the
protect data (IP rules with data base or data protection rules). In
its obligations under this Agreement and
Implementing
and
Delegated
Acts
this case, data shall not be modified or deleted by the M/I so that it
is paradoxical to state that it is the owner of data. I recommend not
shall not suspend the provision of any
adopted by the European Commission to
to refer to the ownership of data and only regulate the access and
Service or other obligations under this
determine the technical standards for the
the prohibition to modify or delete them. It could be included in the
Agreement.
recording, transmitting, processing and
provision on confidentiality and data protection.
storing of data and access to stored data.
Commented [everis90R89]: Support to draft this regulation
8.7. If any amount, in the absence of a
on access an prohibition to modify data would be much appreciated.
dispute, is not paid on the due date, and
10.2. The Manufacturer/Importer has the
Commented
: In which case ? related to 8.5.?
remains unpaid for a period of 15 days
ownership of provided data and the
after receipt by Manufacturer/Importer of
results of any processing of that data. The
a written reminder from the Contractor
Manufacturer/Importer shall not be
sent
by
registered
mail,
entitled to modify or delete the recorded
Manufacturer/Importer shall pay interest
data.
Commented [LM91]: This is more related to the access rights, I
at a rate of 3% per annum calculated on
would move it to the section where this issue is addressed.
a daily basis as from the due date.
10.3. The Contractor does not retain in
Commented [ET92R91]: See comment above.
any way any data or copies of provided
8.8. Contractor acknowledges that
data longer than necessary for the
Commented [CG78]: An article about suspension of the
payment by Manufacturer/Importer of
performance of the Agreement. Upon
contract (not termination) is to be added.
any invoice due will not be deemed to
request by the Manufacturer/Importer,
Commented
: Please refer to the penalties of directive
constitute acceptance of the Services and
the European Commission, or the
2011/07 on late payments. Suspension of services should also be
limited.
is
without
prejudice
to
any
competent authorities, the Contractor
representations or warranties made by
shall delivers a certificate executed by
the Contractor. he prices, the procedures
one of its duly authorised officers,
Commented
: Not necessary here.
for billing and payment with respect to
confirming
compliance
with
the
Commented
: General rule should be included here,
the Service are indicated in Annex B to
destruction obligations.
including payment term, possible penalty in case of late payment (cf.
the STS “PC”.
directive 2011/7). Is it allowed to suspend the service in case of late
10.4. The above provisions apply without
payment (this point should be regulated) ?
9. Location and subcontracting
prejudice to any of the Contractor´s
Commented
Location in the EU territory should be
obligations in connection with termination
mentioned. Should it also be a UE provider?
9.1. The Contractor’s facilities providing
following Section 16 “Data portability”.
the Service are located on the territory of
the European Union. In the case that the
11. Intellectual Property Rights
Commented
: Please add, for clarity purposes, that data
borders of the European Union change
storage facilities are also included and must be located on the UE
during the execution of the Service, the
territory.
2017
10
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
11.1. Unless otherwise expressly agreed
entire duration of protection of the IPR,
elsewhere in this Agreement:
irrevocable and worldwide license to use
the Pre-existing IIPR of Contractor, if and
(i) no Intellectual Property Rights are
to the extent necessary or useful to
intended to be transferred as a result of
benefit from the Service provided and to
this Agreement and nothing in this
use the system, for any purpose; for the
Agreement
will
result
in
avoidance of doubt, this shall include in
Manufacturer/Importer having any right,
particular, without being limited to, the
title, licence to or interest in any Pre-
right to execute, display, install, test,
existing IPR of the Contractor in respect
reproduce,
distribute,
sub-licence,
of which all rights are hereby expressly
modify, maintain, enhance, commercially
reserved, and
exploit and create derivative works of, to
grant sublicenses to third parties and to
(ii) all right, title and interest in relation
further develop the Pre-existing IPR (and
to the Newly Developed IPR shall
any third party IPR incorporated or
Commented
: Is it going to occur?
automatically
be
assigned
to
delivered by Contractor:
Manufacturer/Importer on payment of the
applicable charges in respect of the same
- contained in the system;
with the Contractor executing such
documents as are necessary to give effect
-
otherwise
delivered
to
to such assignment. The assignment will
Manufacturer/Importer by the Contractor
be valid for the whole duration of the
or required to use, maintain or develop
protection and for the territory of
the system; and
[country of Manufacturer/Importer].
-
to
permit
such
use
by
11.2. Licence of Pre-existing IPR:
Manufacturer/Importer.
Manufacturer/Importer grants to the
Contractor, as of the effective date, a
12. Auditing
Commented
: To be completed : When? Who? Object of
non-exclusive,
royalty-free,
sub-
the audit? What will occur in the case of non-compliance? Could it
licensable,
non-transferrable
and
12.1. The Contractor shall grant to the
be asked by the Commission?
worldwide licence to use the Pre-existing
European Commission, the competent
IPR of Manufacturer/Importer for the
authorities of the Member States and any
duration and exclusive purpose of its
external auditor appointed by the
performance under this Agreement.
Commission access to the Contractor
Contractor may user the Pre-existing IPR
facilities and all locations that are
of Manufacturer/Importer as provided
otherwise relevant to this Agreement and
herein, but has no obligation to do so. If
will provide reasonable support as
Contractor uses Pre-existing IPR of
required during the Term of this
Manufacturer/Importer, the Contractor
Agreement in order to undertake the
shall be responsible for verifying and
following actions in relation to the
ensuring that:
Services and Contractor’s obligations
under this Agreement:
(i) such Pre-existing IPR is fit for purpose,
and
(i)
access to the build and test
environments of the Contractor to verify
(ii) none of the license types or terms
compliance with Contractor’s obligations
applicable to such Pre-existing IPR (if
under this Agreement;
any), as provided to Contractor, restrict
Contractor’s ability to transfer ownership
(ii) verification of Contractor compliance
and/or grant the licenses to Pre-existing
with legal and regulatory requirements;
IPR and Newly Developed IPR (as the
(iii) verification of the accuracy of the
case may be) as provided in this
charges in connection with the Services,
Agreement.
and any other amounts payable or
11.3. Contractor hereby grants to
receivable by manufacturer/importer
Manufacturer/Importer,
as
of
the
under this Agreement;
effective date, a non-exclusive, royalty-
(iv) verification that the Contractor’s
free, sub licensable, transferrable, for the
systems protect the integrity, operational
2017
11
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
availability and security of data and
14.2.
Indirect
damages:
without
Commented
: No limitation of liability in case of wilful
Confidential Information; and
prejudice to the article of this Agreement,
misconduct or gross negligence.
neither Party shall be liable for all claims,
(v) verification that the Services are being
proceedings, damages, expenses, costs
provided, and Contractor’s obligations are
and losses that are indirect or
being met, in accordance with this
consequential,
including
without
Agreement.
limitation loss of profit, loss of
opportunity, loss of nosiness, loss of
12.2. If a material non-compliance is
reputations, loss of savings, loss of
found in relation to any of the matters
clientele, loss of data relating to the
which were audited in accordance with
Contractor, and loss of goodwill, as well
this article, the Contractor shall bear the
as third parties’ claims (“Indirect
full
costs
incurred
by
Damages”), whether based on a
Manufacturer/Importer for the audit,
contractual
breach,
tort
(include
inspecting and/or monitoring where the
negligence), breach of statutory duty,
error or non-compliance was found.
hidden or latent defect, or otherwise,
Commented
: Check conformity with 15(8), al.2, stating
that external auditor is paid by the tobacco manufacturers.
The compliance of the Service with this
regardless of whether the damages were
Agreement and the Directive is monitored
foreseeable, arising out of, in connection
by an external auditor proposed and paid
with its participation in the Services
by the Manufacturer/Importer and
and/or performance of its obligations
approved by the European Commission.
under this Agreement.
11.2. The external auditor submits an
It is expressly agreed that the limitation
annual
report
to
the
competent
of liability for Indirect Damages stipulated
authorities
and
to
the
European
under this article does not cover a loss of,
Commission, assessing in particular any
damage to, or any third party claims
irregularities in relation to access to data
arising
out
of,
or
relating
to,
stored in the performance of the Service.
manufacturer/importer data.
Commented
: Too broad. Will never be accepted by
the market. Reference could be made to article 6 or 7 for instance.
13.
Obligations
of
the
14.3. Liability cap: Contractor’s liability
Commented
: To be completed. Data to be provided?
Manufacturer/Importer
arising out of, in connection with its
When? Etc. + Structure : just after the provision related to the
participation in the Services and/or
obligation of the Contractor
13.1.
The
Manufacturer/Importer
performance of its obligations under this
provides all the contributions regarding
Agreement shall be limited to an amount
the provision, implementation and testing
equal to one hundred and twenty five per
of the Service as expressly defined in the
cent (125%) of the total charges that are
Annex 1 “Technical Requirements”.
due to the Contractor in one calendar year
Commented
: Not clear. To be completed or deleted.
under this Agreement.
13. Delays and penalties
Without
prejudice
to
13.1. The Contractor shall notify the
Manufacturer/Importer’s obligation to
Manufacturer/Importer any delays in the
pay charges properly due, the total
provision of the service.
aggregate
liability
of
Commented
: To be included in main duties
Manufacturer/Importer arising out of or in
14. Liability
connection with this Agreement, whether
Commented
: To be reviewed and completed. What are
in contract, tort (including negligence) or
the limitations of liability (indirect damages? CAP?). Some damages
14.1. Direct damages: the Contractor
breach of statutory duty or otherwise,
could be excluded from the limitation (breach of confidentiality or
shall be liable for and shall hold harmless,
howsoever arising, shall be limited to one
data protection rules, for instance).
defend
and
indemnify
hundred thousand Euros (100.000 EUR).
Commented
: Cap must be determined on a case by
Manufacturer/Importer from and against
case basis. Realistic to include it in a model contract?
any direct damages arising out of or
The Contractor is liable to compensate the
relating to its performance under this
Manufacturer/Importer for all damage or
Agreement whether based on an action or
expenses it incurs as a result of a culpable
claim, in contract, equity, negligence,
breach of the Agreement by the
Commented
: What does it mean? Recommended to
tort, or otherwise, for all events, acts or
Contractor.
refer to material breach.
omissions.
14.2. Save Section 13 “Delays and
penalties”, the amount due by the
2017
12
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
Contractor for default of the Agreement is
Majeure Event, the non-performing Party
defined in the relevant STS.
shall be excused from the performance of
its obligations pursuant to this Agreement
14.3. The Contractor is not responsible
affected by the Force Majeure Event for
for loss of profits, loss of earnings or for
as long as (1) such Force Majeure Event
any other form of loss of profit or
continues and (2) such Party continues to
damage, delays or malfunctions however
use its best efforts to recommence
derived from the provision of the Service
performance whenever and to whatever
which depend on events beyond the
extent possible without delay.
reasonable control of the Contractor such
as, for example:
15.3. The Party delayed by a Force
Majeure Event shall immediately notify
a) force majeure events;
the other Party by telephone or any other
Commented
: To be defined.
pre-agreed warning (to be confirmed in a
b) events dependent on the acts of third
notice within 1 day of the inception of
parties such as, but not limited to, the
such delay) of the occurrence of a Force
interruption
or
malfunction
of
Majeure Event and describe in reasonable
telecommunication lines and/or electric
detail the nature of the Force Majeure
power networks;
Event.
c) malfunction of the terminals or other
15.4. Manufacturer/Importer will be
communications systems used by the
entitled to cease payment of the price
Manufacturer/Importer or improper use
and/or to recover from the Contractor any
of the same and/or the procedures for
of the charges already paid in connection
access
to
the
service
by
the
with the defaulting services until the
Manufacturer/Importer or third parties.
recovery of from such Force Majeure
15. Force Majeure
Event has been completed and in so doing
may
perform
any
act
that
Commented
: Probably too many details.
15.1. “Force Majeure Event” means an
Manufacturer/Importer
deems
Commented
: I suggest not to define the concept but
occurrence or circumstance, other than
reasonably necessary in order to restore
refer, in this model contract, to the meaning in accordance with the
financial, beyond a Party’s control, which
the Services or procure the Services from
applicable law.
was unforeseeable on the effective date
an alternate source.
and which such Party cannot avoid,
including but not limited to an act of God,
15.5. If such Force Majeure Event causes
fire, flood, storm, revolution, act of
delay in performance for more than thirty
terrorism, riot, war or civil commotion
(30) days, then the Party not suffering
(but excluding strikes and industrial
the Force Majeure Event may terminate
disputes of the affected Party), any
this
Agreement,
without
cost,
failures of power or other utilities, surplus
compensation or indemnity, effective
or shortage of, or any delay in or inability
upon written notice to the other Party.
to procure or remove, any labour,
15.6. The occurrence of a Force Majeure
materials, equipment or supplies.
Event does not limit or otherwise affect
Commented
: Not clear
15.2. Any failure or delay by the
Contractor’s obligation to provide either
Manufacturer/Importer or the Contractor
normal business continuation procedures
in the performance of their obligations
and/or to ensure full compliance with the
pursuant to this Agreement due to a Force
Business
Continuity
Plan
for
the
Majeure Event shall not be deemed a
continuation of business.
breach of this Agreement of a ground for
15.7. Forthwith upon the Force Majeure
termination
hereunder
(expect
as
Event ceasing to exist, the Party relying
provided hereunder) provided that such
upon the Force Majeure Event shall give
failure or delay could not have been
written advice to the other Party of this
possibly prevented and cannot possible
fact and resume performance of the
be circumvented by the non-performing
affected obligations.
Party through the use of alternate
sources, workaround plans, or other
16.
Insurance and guarantee
means. Upon the occurrence of a Force
Commented
I suggest to delete because issues could
occur when articulating this rule with the definition.
2017
13
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
16.1. The Contractor provides evidence of
165.2. The Contractor shall have no right
an insurance to Manufacturer/Importer
of retention with respect to any data,
against all insurable risks of damage, loss
information and/or other necessary
or injury caused by the Contractor in the
material to be delivered to the next
execution of the Agreement including any
Contractor and allow full data portability
act by its personnel or by any person
in accordance with this Section 16 “Data
acting on the Contractor's behalf for the
portability”.
performance of the Agreement.
17. Termination
Commented
Not clear. Distinction must be made
16.2 The insurance is the type customary
between termination for cause and termination for convenience
for the industry sector in which the
17.1. Termination for cause by the
(and we recommend not to allow termination for convenience in the
Contractor operates and shall include
Manufacturer/Importer:
without
present case). Reference should be made to material breach (and
not to serious cause). Insolvency should also be mentioned, being
insurance cover for professional and
prejudice to any right or remedy
agreed that it is not a breach as such. Duties after termination must
corporate liability, providing cover for at
Manufacturer/Importer may have against
be mentioned (ref. to exit plan).
least the amount defined in the STS. In
the Contractor for breach or non-
Commented
: What about termination for cause by the
any case, the minimum amounts
performance
of
this
Agreement,
Contractor? Suggestion to add another clause or to apply this
stipulated
shall
not
prevent
the
Manufacturer/Importer may terminate
provision to both Parties.
Contractor from complying with the
this Agreement for cause, without prior
obligation to insure itself for higher
intervention of a court or arbitral body
amounts, where such would be the case,
and without any financial liability to the
as provided in statutory provisions.
Contractor at any time on notice in writing
Furthermore, the amounts of insurance
to the Contractor immediately or
stipulated shall in no way limit or diminish
forthwith following such notice period as
the obligation of the Contractor to
described below if:
compensate the Manufacturer/Importer
for damage incurred.
(i) Contractor commits a material breach
of any of its obligations or the terms and
15.3. The Contractor provides at his own
conditions set out in this Agreement,
expense, as security for due performance
provided that where such breach is
of the Agreement, including the obligation
capable of remedy, Contractor has been
to pay a contractual penalty, a guarantee
notified in writing of the breach and has
for the amount to be secured, issued by
not remedied it within thirty (30) days of
an established credit institute of good
receipt of such notice;
standing registered the European Union.
The guarantee must in all cases be
(ii) any of the representations, warranties
directly
enforceable,
unconditional,
and undertakings given by the Contractor
irrevocable and issued for the duration of
have become materially inaccurate during
obligations set forth in the Agreement and
the term of the Agreement;
according to the applicable law.
(iii) following an independent review by a
16.4. At the Contractor's request, the
qualified external party that Contractor is
Manufacturer/Importer returns to the
not, or will not be, able to complete the
former or the guarantor any guarantee
Services
within
the
timescale
deeds provided to it as soon as it is
contemplated in this Agreement,
established
that
the
(iv) Contractor is in material breach and
Manufacturer/Importer can no longer
fails to remedy the material breach within
invoke any of the rights secured by the
thirty (30) days.
guarantee.
(v) Contractor is in breach of its
165. Data portability
obligations relating to confidentiality,
Commented
: To be reviewed and completed. An
“exit” plan must be established (information duties before to
165.1. The Contractor delivers to the next
security and/or Data Protection
terminate ; format ; price, collaboration duty, timeline, choice of the
Contractor with an up to date backup of
next Contractor, etc.).
(vi) Contractor or any staff are in breach
the data stored in the performance of the
of any anti-corruption laws;
Service. Any updates to data after this
delivery and any additional data received
(vii) Manufacturer/Importer exercises its
or created shall be migrated to the next
right to terminate all or part of the
Contractor without undue delay.
2017
14
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
Agreement under article X (“Price, billing
18. Termination Assistance, Data and
and payments”); and/or;
knowledge transfer
Commented [CG112]: Not aligned with Art. 7 Pricing: there is
no longer a reason for terminating the contract due to non-
(viii) as a result of a fault or negligence
18.1. Following notice of termination of
payment. I would remove this paragraph.
on behalf of Contractor, Contractor is
this Agreement for any reason, the
refused or has revoked any official or
Contractor shall provide termination
regulatory licence, authorisation or
assistance as is reasonably required for
permission necessary for the performance
such period of time as is reasonable in
of its obligations hereunder and such
order to provide for an orderly
breach is not cured within one (1) month
disengagement and (where applicable)
notice.
seamless
transition
to
the
next
Commented
: Is it applicable here?
Contractor.
17.2. Termination by Contractor: if
Manufacturer/Importer fails to pay any
18.2. Contractor shall perform the
undisputed charges exceeding three (3)
termination assistance services described
months of all charges under the
in this Agreement. In particular, the
Agreement within the time provided for
Contractor shall:
by this Agreement, Contractor may give
Manufacturer/Importer notice of its
(i) transfer the services, the system
intention to terminate this Agreement if
and/or work products to the next
payment is not received within thirty (30)
Contractor in a reasonable time frame;
days of that notice.
(ii)
assist
with the handover of
The Parties may terminate the Agreement
operational responsibility to the next
following the instructions provided in the
Contractor.
relevant STS.
Commented
:
18.3. The Contractor will provide an
To be regulated in the GTC.
17.2. If the Manufacturer/Importer has
interim and a final Termination Assistance
serious cause, it may terminate the
Plan following the guidelines of this
Commented
Not clear. Distinction must be made
Agreement in writing without advance
Agreement. Within sixty (60) days of the
between termination for cause and termination for convenience
notice. There is serious cause, in
notice of termination of the Agreement,
(and we recommend not to allow termination for convenience in the
particular, where:
the Contractor will deliver an initial
present case). Reference should be made to material breach (and
Termination Assistance Plan to the
not to serious cause). Insolvency should also be mentioned, being
agreed that it is not a breach as such. Duties after termination must
(a)
the
Contractor's
financial
European Commission for its review and
be mentioned (ref. to exit plan).
circumstances deteriorate to such an
feedback.
Commented [LM116]: This provision is too unclear, allowing for
extent that due performance of the
the possibility to terminate the contract in case of "serious causes" is
Agreement can no longer be expected;
18.4. Providing data: on written request
too vague.
during the Termination Assistance Period,
Commented [ET117R116]:
(b)
the Contractor becomes, or is at
the
Contractor
will
provide
data
The cases of “serious causes” are
described hereinafter.
risk of becoming, insolvent or is over-
regarding:
indebted;
(i)
Consumption and utilisation of
(c)
the
opening
of
insolvency
resources
proceedings or comparable statutory
proceedings
with
respect
to
the
(ii) Business process procedures and work
Contractor's assets is refused owing to
flow
lack of funds or the Contractor finds
himself in a comparable situation under
(iii)
Business process volumes and
the laws of the country in which he is
statistics
Commented [LM118]: For the purpose of the tracking and
domiciled;
tracing system, I don't think it is beneficial to allow an immediate
(iv) Business process training modules
termination of the agreement
17.3. The Manufacturer/Importer shall
Commented [ET119R118]: Please pay attention following
(v) Performance histories
immediately terminate the Agreement if
sentence. Immediate termination of the agreement by the
notified by the European Commission that
manufacturer/importer is allowed only “ if notified by the European
(vi) Then current and projected work
Commission that the Contractor no longer meets the necessary
the Contractor no longer meets the
volumes
requirements with respect to independency and technical capacities
necessary requirements with respect to
set forth in the Directive”.
independency and technical capacities set
(vii) Any other data reasonably requested
forth in the Directive.
In this situation, the Agreement would need to be terminated
by the European Commission about the
immediately. As the European Commission is not a party to the
Agreement, it has to be terminated by the manufacturer/importer.
2017
15
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
services as necessary for the next
Contractor to assume responsibility for
continued performance of the services.
19.
Amendments
to
GTS
and
STSAgreement
18.5. Contractor will provide for a transfer
of knowledge about the services and
19.1 Pursuant to Article 15(8) and (10) of
related topics (which may be specified in
the Directive, Parties do not have the
the Termination Assistance Plan) to
right to amend the GTS and STSthis
facilitate the provision of replacement
Agreement. The European Commission
services by the next Contractor. This will
reserves the right to regularly monitoring
include:
and evaluating modifications to the GTS
and STSAgreement by means of
(i) participate in workshops, meetings,
delegated acts in accordance with Article
and
“hands-on”
activities
where
27 of the Directive.
requested by the European Commission;
20. Applicable law and disputes
Commented
: It should be the Law and the Jurisdiction
(ii) Provide the next Contractor with
of a Member State. The Agreement could also include an out-of-
information about the services that are
21.1. The Agreement is governed by the
court resolution process (arbitration or mediation) and an escalation
necessary to implement the Termination
law of ______________.
process (first refer to project managers and then higher and then
higher, with compulsory timeline).
Assistance Plan; and,
20.1. In the event of Aany dispute arising
Commented [everis123R122]: Modified. Dispute resolution
(iii) Provide the next Contractor with
out of, or in connection with, this
procedure included SUBJECT TO the approval of the Governance
Model by the EC.
information about the services as
Agreement, each Party agrees, without
necessary for the next Contractor to
prejudice to the right of each Party to
assume responsibility for continued
immediately seek any interim or final
performance of the services in an orderly
remedy before the court as set forth in
manner so as to minimize disruption to
20.4, to attempt in good faith to resolve
the operations;
the dispute amicable and speedily by
referring such dispute by written notice:
18.6. The Contractor will deliver to the
next Contractor with an up to date backup
i) first to the Service Delivery Committee,
of the data stored in the performance of
who shall meet and endeavour to resolve
the Service. Any updates to data after this
the dispute between them within fifteen
delivery and any additional data received
(15) business days of such notice,
or created shall be migrated to the next
Contractor without undue delay.
ii) failing resolution of the dispute, to the
Management Committee, who shall meet
18.7. The Contractor shall have no right
and endeavour to resolve the dispute
of retention with respect to any data,
between them within ten (10) business
information and/or other necessary
days of such notice. The joint written
material to be delivered to the next
decision of the Management Committee
Contractor and allow full data portability
shall be binding on the Parties, and;
in accordance with this Agreement.
iii) failing resolution of dispute, to the
18. Structure of the Agreement
Executive Steering Committee who shall
meet and endeavour to resolve the
18.1 The present Agreement consists of:
dispute between them within fifteen (15)
business days of such notice. The joint
Commented [LM120]: This is too complicated. For the purpose
- General Terms of Service (GTS)
written decision of the Executive Steering
of drafting a model contract you should simply the structure, ideally
to one single document
Committee shall be binding on the
- Annex 1 to the GTS “Technical
Parties.
Commented [ET121R120]: We have reviewed this matter
Requirements”
with our external legal advisors and this is the most common and
accepted standard for cloud storing agreements. In comparison with
20.2. If the Service Delivery Committee,
- Special Terms of Service (STS)
other model contracts of this nature, this is the most simple that it
the Management Committee and the
can already get.
- Annex A to the STS “SLA”
Executive Steering Committee are unable
to resolve the dispute, the dispute
We suggest to keep this structure and discuss it with the external
expert(s) during the review.
- Annex B to the STS “PC”
resolution shall be considered at an end
as regards the dispute at stake, unless
Commented
]:
the Parties agree to refer the matters in
Parties should be able to amend this
process in accordance with their own practice.
2017
16
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
dispute to a non-binding arbitration,
in the light of its object and purpose of
expert’s assessment, or mediation, in
the Directive.
which case, the dispute resolution
procedure shall be considered at an end
On behalf of the Contractor:
should the findings or recommendations
Name (written in full):
resulting from such additional non-
Position:
binding procedure are not acceptable to
Address:
both Parties.
Signature……………………………………….
(stamp of organisation)
20.3. In either party does not agree with
On
behalf
of
the
any
dispute
being
referred
for
Manufacturer/Importer:
determination in accordance with sub-
Name (written in full):
article 20.1, then the dispute shall be
Position:
determined by the [UE country of
Address:
Manufacturer/Importer]
courts
in
Signature……………………………………….
accordance with the following sub-article.
(stamp of organisation)
20.4. The construction, validity an
performance of this Agreement and all
non-contractual obligations arising from
or connected with this Agreement shall be
governed
by,
and
construed
in
accordance with, the Laws of [UE country
of Manufacturer/Importer] and any
dispute arising out of this Agreement shall
be subject to the exclusive jurisdiction of
the courts of [courts of the seat of the
Manufacturer/Importer] to which both
Parties
hereby
agree
to
submit
irrevocably for these purposes.
between the Parties resulting from the
interpretation or application of the
Agreement which cannot be settled
amicably shall be brought before the
courts of ______________.
21. Miscellaneous
Commented
: Add a clause for consistency issues
between the documents.
21.1 The Agreement constitutes the
entire agreement between the Parties.
There are no oral agreements or
understandings. Any amendment or
addition to the Agreement, where
possible, must be in writing. Any waiver
of the requirement of written form must
likewise be in writing.
21.2 Should a clause of the Agreement
be or become invalid, the remainder of
the Agreement remains in force. The
invalid clause must be replaced by a valid
clause coming closest to achieving the
object and purpose of the invalid clause.
21.3 If the Agreement contains any
gaps or ambiguities, it is to be interpreted
2017
17
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Page 18 was entirely deleted as it falls outside the scope of the request
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
8.2. Special Terms of Services - Primary Data Storage
Special Terms of Service (“
STS”)
- Primary Data Storage –
Commented
: To be included in the GTC or in a specific
work order.
Reference Number ___[…]___
Service
Primary Data Storage means the independent Primary Data Storage solution,
hosting data exclusively related to a specific Manufacturer/Importer or a group of
distinct Manufacturer(s)/Importer(s).
The Service shall include making available to the Manufacturer/Importer a
development and a test environment for the Service in accordance with the
Commented [LM127]: This is really not clear. Please define
requirements and for the purposes described in the Annex 1 to GTS “Technical
better what the contractor should do
Requirements”.
Commented [ET128R127]: The specific tasks and technical
specifications are to be defined in the Technical Annex for each of
Terms, renewal The Service shall be provided for a period of X (X) years from the signature of the
the services (primary DS and surveillance DS). This is a common
and termination contract.
practice in cloud storing agreements. The technicalities and
specifications of this kind of storages are too complex to be included
The Initial Contract Period may be extended, at the exclusive option of the
in the body of the Agreement itself.
Manufacturer/Importer, by X (X) further periods of X (X) year each ("
Extension
Period"), upon the Manufacturer/Importer giving written notice to the Contractor
As WP3 (“Technical Specifications”) has not been finalised yet, the
at least X (X) months before the end of the Initial Contract Period or the
Annex 1 to GTS “Technical Requirements” has not been drafted yet.
subsequent Extension Period.
Option: The Manufacturer/Importer may terminate at any time the Agreement,
without the need to state reasons, by serving a 90 (ninety)-day written notice to
the Contractor.
Liability
The Contractor’s liability according to Section 14 “Liability” of the GTS shall be
limited to an amount of EUR XXXX (in words: XXXX Euros) per event, whereby a
single event shall be considered present in the case of a sequence of connected
events (occurrences), and to an amount of EUR XXXX (in words: XXXX Euros) per
calendar year in the case of multiple events.
Insurance
The insurance according to Section 15 “Insurance and guarantee” of the GTS shall
include insurance cover for professional and corporate liability and will provide
cover for at least EUR XXXX (in words: XXXX Euros) per event, with the maximum
annual cover of at least XXX% (XXXX) of this amount.
Contractual
Where performance of the Service is delayed, the Contractor is liable to pay a
Commented
: What does it mean? In the case of data
penalty
contractual penalty at a rate of 0.2% per working day of such delay but subject to
storage, it is not really a delay issue.
a maximum of 5% of the net price of the delayed part of the Service.
2017
19
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Page 20 was entirely deleted as it falls outside the scope of the request
Implementation analysis of a EU system for traceability and security features of tobacco products
Interim Report III
ANNEX A 1 – SERVICE LEVEL AGREEMENT (“
SLA”)
Commented
: To be completed.
1. Availability and performance of the Service
1.1
The Service must be operational and fully functional at all times.
In the event that the Service does not meet the requirement referred to in the previous
sentence, the Contractor shall compensate the Manufacturer/Importer.
1.2
Should the Contractor claim that the non-availability of the Service is caused by
circumstances beyond the Contractor’s control, the Contractor shall not be liable to pay
liquidated damages, provided that the Contractor provides evidence of such circumstances.
1.3
The Contractor shall cooperate with any reasonable request by the
Manufacturer/Importer to improve its performance on a structural basis such as, but not
limited to, the Contractor applying more resources and/or revising its procedures and/or
involving the Manufacturer/Importer more closely in problem solving operations, where it
has been established that the Contractor does not meet on a regular basis the requirements
and/or Service Levels set out in this Agreement. In this respect, the Contractor shall also
cooperate with any analysis of the causes of non-compliance requested by the
Manufacturer/Importer and shall allow the Manufacturer/Importer to perform such
analyses.
2. Support
2.1
The Contractor makes available to the Manufacturer/Importer a telephone and/or
e-mail hotline service for providing support, which is available on all working days (from
___day_____to day___) in the following working hours (from ____h to ____h).
3. Data portability
3.1
During the latest 60 (sixty) days before the expiry/termination of this Agreement
(according to Section 3 of the STS), at no additional costs to the Manufacturer/Importer,
the Contractor shall deliver to the next contractor indicated by the Manufacturer/Importer
a complete and up-to-date version of the data stored. Any updates to these data after this
delivery and any additional data received or created shall be migrated to the next
contractor without undue delay.
2017
21
Consumers, Health, Agriculture and Food Executive Agency
Health Programme
Pages 22 to 29 were entirely redacted as they fall outside the scope of the request