8.5.1992 EN Official Journal of the European Communities L 123/19 COUNCIL DECISION of 31 March 1992 in the field of security of information systems (92/242/EEC) THE COUNCIL OF THE EUROPEAN COMMUNITIES, Having regard to the Treaty establishing the European Economic Community, and in particular Article 235 thereof, Having regard to the proposal from the Commission (1), Having regard to the opinion of the European Parliament (2), Having regard to the opinion of the Economic and Social Committee (3), Whereas the Community has as its task, by establishing a common market and progressively approximating the economic policies of the Member States, to promote throughout the Community a harmonious development of economic activities, a continuous and balanced expansion, an increase in stability, an accelerated raising of the standard of living and closer relations between the Member States; Whereas information stored, processed and transmitted electronically plays an increasingly important role in economic and social activities; Whereas the advent of efficient global communications and the pervasive use of electronic handling of information emphasizes the need for adequate protection; Whereas the European Parliament has repeatedly stressed the importance of the security of information systems in its debates and resolutions; Whereas the Economic and Social Committee has emphasized the need to address issues relating to the security of information systems in Community forms of action, particularly in view of the impact of the completion of the internal market; Whereas forms of action at national, international and Community levels provide a good basis; Whereas there is a close link between telecommunications, information technology, standardization, the information market and research, development and technology (RDT) policies, as well as the work already undertaken in these areas by the Community; Whereas it is appropriate to ensure that efforts are concerted by building on existing national and international work and by promoting cooperation between the principal parties concerned; whereas it is therefore appropriate to proceed within the framework of a coherent action plan; Whereas the complexity of the security of information systems calls for the development of strategies to enable the free movement of information within the single market while ensuring the security of the use of information systems throughout the Community; Whereas it is the responsibility of each Member State to take into account the constraints imposed by security and public order; Whereas the responsibilities of the Member States in this area imply a concerted approach based on close collaboration with senior officials of the Member States; Whereas provision should be made for a plan of action for an initial period of twenty-four months and the setting-up of a Committee of Senior Officials with a long-term mandate to advise the Commission on forms of action in the area of security of information systems; Whereas an amount of ECU 12 million is considered necessary to implement the action for an initial period of twenty-four months; whereas for 1992, in the context of the present financial perspective, the amount estimated necessary is ECU 2 million; Whereas the amounts to be committed in order to finance the programme for the period following the 1992 budget year will form part of the existing Community financial framework, HAS DECIDED AS FOLLOWS: Article 1 An action in the field of the security of information systems is hereby adopted. It comprises: — development of overall strategies for the security of information systems (action plan) for an initial period of 24 months, and — setting-up Senior Officials Group with a long-term mandate to advise the Commission on action to be undertaken in the field of the security of information systems, hereinafter referred to as the ‘Committee’. Article 2 1. The Commission shall consult the Committee systematically on issues relating to the security of the information systems for the various activities carried out by the Community, in particular on the definition of work strategies and programmes. 2. The action plan, as indicated in the Annex, shall include preparatory work under the following themes: I. development of a strategic framework for the security of information systems; II. identification of user and service provider requirements for the security of information systems; III. solutions for immediate and interim needs of users, suppliers and service providers; IV. development of specifications, standardization, evaluation and certification in respect of the security of information systems; V. technological and Operational developments in the security of information systems; VI. provision of security of information systems. Article 3 1. The Community funds estimated as necessary for the execution of the action amount to ECU 12 million for the initial period, including ECU 2 million for 1992 within the 1988-1992 financial perspective. For the subsequent period of application of the programme, the amount will have to be included in the Community financial framework in force. 2. The budgetary authority shall determine the appropriations available for each financial year, taking into account the principles of sound management referred to in Article 2 of the Financial Regulation applicable to the general budget of the European Communities. Article 4 An evaluation of the progress achieved during the initial period shall be carried out for the Commission by a group of indepedent experts. This group's report, together with any comments by the Commission, shall be submitted to the European Parliament and the Council. Article 5 1. The Commission shall be responsible for implementing the action. It shall be assisted by an advisory committee composed of representatives of the Member States and chaired by the representative of the Commission. 2. The action plan shall be implemented in accordance with the objectives set out in Article 2 and updated where necessary. It shall set out the detailed objectives and types of actions to be undertaken, and the financial arrangements to be made for them. The Commission shall make calls for proposals on the basis of the action plan. 3. The action plan shall be implemented in close collaboration with the sector actors. It shall take into account, promote and complement the European and international standardization activities under way in this field. Article 6 1. The procedure laid down in Article 7 shall apply to: — measures relating to Community policy in the field of the security of information systems; 2. The procedure laid down in Article 8 shall apply to: — the preparation and updating of the action plan referred to in Article 5; — the contents of the calls for proposals, the assessment of proposals and the estimated amount of the Community's contribution to measures where this amount exceeds ECU 200 000; — the cooperation in any activity under this Decision of non-Community organizations; — arrangements for the dissemination, protection and exploitation of the results of the measures; — the measures to be undertaken to evaluate the action. 3. Where the amount of the Community contribution to the measures is less than, or equal to, ECU 200 000, the Commission shall consult the Committee on the measures to be taken and inform the Committee of the outcome of its assessment. Article 7 The representative of the Commission shall submit to the Committee a draft of the measures to be taken. The Committee shall deliver its opinion on the draft, within a time limit which the Chairman may lay down according to the urgency of the matter, if necessary by taking a vote. The opinion shall be recorded in the minutes; in addition, each Member State shall have the right to ask to have its position recorded in the minutes. The Commission shall take the utmost account of the opinion delivered by the Committee. It shall inform the Committee of the manner in which its opinion has been taken into account. Article 8 The representative of the Commission shall submit to the Committee a draft of the measures to be taken. The Committee shall deliver its opinion on the draft within a time limit which the Chairman may lay down according to the urgency of the matter. The opinion shall be delivered by the majority laid down in Article 148 (2) of the Treaty in the case of decisions which the Council is required to adopt on a proposal from the Commission. The votes of the representatives of the Member States within the Committee shall be weighted in the manner set out in that Article. The Chairman shall not vote. The Commission shall adopt the measures envisaged if they are in accordance with the opinion of the Committee. If the measures envisaged are not in accordance with the opinion of the Committee, of if no opinion is delivered, the Commission shall, without delay, submit to the Council a proposal relating to the measures to be taken. The Council shall act by a qualified majority. If, on the expiry of a period of three months from the date of referral to it the Council has not acted, the proposed measures shall be adopted by the Commission, save where the Council has decided against the said measures by a simple majority. Done at Brussels, 31 March 1992. For the Council The President Vitor MARTINS (1) OJ No C 277, 5. 11. 1990, p. 18. (2) OJ No C 94, 13. 3. 1992. (3) OJ No C 159, 17. 6. 1991, p. 38. ANNEX Summary of action lines ORIENTATIONS FOR AN ACTION PLAN IN THE FIELD OF THE SECURITY OF INFORMATION SYSTEMS INTRODUCTION The action plan shall have as its objective the development of overall strategies aiming to provide users and producers of electronically stored, processed or transmitted information with appropriate protection of information systems against accidental or deliberate threats. The action plan shall take into account and complement the world-wide standardization activities under way in this field. It shall include the following lines of action: — development of a strategic framework for the security of information systems; — identification of user and service provider requirements for the security of information systems; — solutions for immediate and interim needs of users, suppliers and service providers; — development of specifications, standardization, evaluation and certification in respect of the security of information systems; — technological and operational developments in the security of information systems; — provision of security of information systems. The action plan shall be implemented by the Commission, in close association with related actions in Member States and in conjunction with related Community research and development actions. 1. Action line I — Development of a strategic framework for the security of information systems 1.1. Issue Security of information systems is recognized as a pervasive quality necessary in modern society. Electronic information services need a secure telecommunications infrastructure, secure hard- and software as well as secure usage and management. An overall strategy, considering all aspects of security of information systems, needs to be established, avoiding a fragmented approach. Any strategy for the security of information processed in an electronic form must reflect the wish of any society to operate effectively yet protect itself in a rapidly changing world. 1.2. Objective A strategically orientated framework has to be established to reconcile social, economic and political objectives with technical, operational and legislative options for the Community in an international context. The sensitive balance between different concerns, objectives and constraints are to be found by sector actors working together in the development of a common perception and agreed strategy framework. These are the prerequisites for reconciling interests and needs both in policy-making and in industrial developments. 1.3. Status and trends The situation is characterized by growing awareness of the need to act. However, in the absence of an initiative to coordinate efforts, it seems very likely that dispersed efforts in various sectors will create a situation which will de facto be contradictory, creating progressively more serious legal, social and economic problems. 1.4. Requirements, options and priorities Such a shared framework would need to address and situate risk analysis and risk management concerning the vulnerability of information and related services, the alignment of laws and regulations associated with computer/telecommunications abuse and misuse, administrative infrastructures including security policies, and how these may be effectively implemented by various industries/disciplines, and social and privacy concerns (e.g. the application of identification, authentication, non-repudiation and possibly authorization schemes in a democratic environment). Clear guidance is to be provided for the development of physical and logical architectures for secure distributed information services, standards, guidelines and definitions for assured security products and services, pilots and prototypes to establish the viability of various administrative structures, architectures and standards related to the needs of specific sectors. Security awareness must be created in order to influence the attitude of the users towards an increased concern about security in information technology (IT). 2. Action line II — Identification of user and service provider requirements for the security of information systems 2.1. Issue Security of information systems is the inherent prerequisite for the integrity and trustworthiness of business applications, intellectual property and confidentiality. This leads inevitably to a difficult balance and sometimes choices, between a commitment to free trade and a commitment to securing privacy and intellectual property. These choices and compromises need to be based on a full appreciation of requirements and the impact of possible options for the security of information systems to respond to them. User requirements imply the security functionalities of information systems interdependent with technological, operational and regulatory aspects. Therefore, a systematic investigation of security requirements for information systems forms an essential part of the development of appropriate and effective measures. 2.2. Objective Establishing the nature and characteristics of requirements of users and service providers and their relation to security measures of information systems. 2.3. Status and trends Hitherto, no concerted effort has been undertaken to identify the rapidly evolving and changing requirements of the major actors for the security of information systems. Member States of the Community have identified the requirements for harmonization of national activities (especially of the ‘IT security evaluation criteria’). Uniform evaluation criteria and rules for mutual recognition of evaluation certificates are of major importance. 2.4. Requirements, options and priorities As a basis for a consistent and transparent treatment of the justified needs of the sector actors, it is considered necessary to develop an agreed classification of user requirements and its relation to the provision of security in information systems. It is also considered important to identify requirements for legislation, regulations and codes of practice in the light of an assessment of trends in service characteristics and technology, to identify alternative strategies for meeting the objectives by administrative, service, operational and technical provisions, and to assess the effectiveness, user-friendliness and costs of alternative security options and strategies for information systems for users, service providers and operators. 3. Action line III — Solutions for immediate and interim needs of users, suppliers and service providers 3.1. Issue At present it is possible to protect adequately computers from unauthorized access from the outside world by ‘isolation’, i.e. by applying conventional organizational and physical measures. This applies also to electronic communications within a closed user group operating on a dedicated network. The situation is very different if the information is shared between user groups or exchanged via a public, or generally accessible, network. Neither the technology, terminals and services nor the related standards and procedures are generally available to provide comparable security for information systems in these cases. 3.2. Objective The objective has to be to provide, at short notice, solutions which can respond to the most urgent needs of users, service providers and manufacturers. This includes the use of common IT-security evaluation criteria. These should be conceived as open towards future requirements and solutions. 3.3. Status and trends Some user groups have developed techniques and procedures for their specific use responding, in particular, to the need for authentication, integrity and non-repudiation. In general, magnetic cards or smart cards are being used. Some are using more or less sophisticated cryptographic techniques. Often this implied the definition of user-group specific ‘authorities’. However, it is difficult to generalize these techniques and methods to meet the needs of an open environment. ISO is working on OSI Information System Security (ISO DIS 7498-2) and CCITT in the context of X400. It is also possible to insert security segments into the messages. Authentication, integrity and non-repudiation are being addressed as part of the messages (EDIFACT) as well as part of the X400 MHS. At present, the Electronic Data Interchange (EDI) legal framework is still at the stage of conception. The International Chamber of Commerce has published uniform rules of conduct for the exchange of commercial data via telecommunications networks. Several countries (e.g. Germany, France, the United Kingdom and the United States) have developed, or are developing, criteria to evaluate the trustworthiness of IT and telecommunication products and systems and the corresponding procedures for conducting evaluations. These criteria have been co-ordinated with the national manufacturers and will lead to an increasing number of reliable products and systems starting with simple products. The establishment of national organizations which will conduct evaluations and offer certificates will support this trend. Confidentiality provision is considered by most users as less immediately important. In the future, however, this situation is likely to change as advanced communication services and, in particular, mobile services will have become all-pervasive. 3.4. Requirements, options and priorities It is essential to develop as soon as possible the procedures, standards, products and tools suited to assure security both in information systems as such (computers, peripherals) and in public communications networks. A high priority should be given to authentication, integrity and non-repudiation. Pilot projects should be carried out to establish the validity of the proposed solutions. Solutions to priority needs on EDI are looked at in the TEDIS programme within the more general content of this action plan. 4. Action line IV — Development of specifications, standardization, evaluation and certification in respect of the security of information systems 4.1. Issue Requirements for the security of information systems are pervasive and as such common specifications and standards are crucial. The absence of agreed standards and specifications for IT security may present a major barrier to the advance of information-based processes and services throughout the economy and society. Actions are also required to accelerate the development and use of technology and standards in several related communication and computer network areas that are of critical importance to users, industry and administrations. 4.2. Objective Efforts are required to provide a means of supporting and performing specific security functions in the general areas of OSI, ONP, ISDN/IBC and network management. Inherently related to standardization and specification are the techniques and approaches required for verification, including certification leading to mutual recognition. Where possible, internationally agreed solutions are to be supported. The development and use of computer systems with security functions should also be encouraged. 4.3. Status and trends The United States, in particular, has taken major initiatives to address the security of information systems. In Europe the subject is treated in the context of IT and telecommunications standardization in the context of ETSI and CEN/CENELEC in preparation of CCITT and ISO work in the field. In view of growing concern, the work in the United States is rapidly intensifying and both vendors and service providers are increasing their efforts in this area. In Europe, France, Germany and the United Kingdom have independently started similar activities, but a common effort corresponding to the United States is evolving only slowly. 4.4. Requirements, options and priorities In the security of information systems there is inherently a very close relationship between regulatory, operational, administrative and technical aspects. Regulations need to be reflected in standards, and provisions for the security of information systems need to comply in a verifiable manner to the standards and regulations. In several aspects, regulations require specifications which go beyond the conventional scope of standardization, i.e. include codes of practice. Requirements for standards and codes of practice are present in all areas of security of information systems, and a distinction has to be made between the protection requirements which correspond to the security objectives and some of the technical requirements which can be entrusted to the competent European standards bodies (CEN/CENELEC/ETSI). Specifications and standards must cover the subjects of security services of information systems (personal and enterprise authentication, non-repudiation protocols, legally acceptable electronic proof, authorization control), their communication services (image communication privacy, mobile communications voice and data privacy, data and image data-base protection, integrated services security), their communication and security management (public/private key system for open network operation, network management protection, service provider protection) and their certification (assurance criteria and levels, security assurance procedures for secure information systems). 5. Action line V — Technological and operational developments in the security of information systems 5.1. Issue Systematic investigation and development of the technology to permit economically viable and operationally satisfactory solutions to a range of present and future requirements for the security of information systems is a prerequisite for the development of the services market and the competitiveness of the European economy as a whole. Any technological developments in the security of information systems will have to include both the aspects of computer security and security of communications as most present-day systems are distributed systems, and access to such systems is through communications services. 5.2. Objective Systematic investigation and development of the technology to permit economically viable and operationally satisfactory solutions to a range of present and future requirements for the security of information systems. 5.3. Requirements, options and priorities Work on security of information systems would need to address development and implementation strategies, technologies, and integration and verification. The strategic R&D work would have to cover conceptual models for secure systems (secure against compromise, unauthorized modifications and denial of service), functional requirements models, risk models and architectures for security. The technology-orientated R&D work would have to include user and message authentication (e.g. through voice-analysis and electronic signatures), technical interfaces and protocols for encryption, access control mechanisms and implementation methods for provable secure systems. Verification and validation of the security of the technical system and its applicability would be investigated through integration and verification projects. In addition to the consolidation and development of security technology, a number of accompanying measures are required concerned with the creation, maintenance and consistent application of standards, and the validation and certification of IT and telecommunication products with respect to their security properties, including validation and certification of methods to design and implement systems. The third RDT Community Framework Programme might be used to foster cooperative projects at precompetitive and prenormative levels. 6. Action line VI — Provision of security of information systems 6.1. Issue Depending on the exact nature of the security features of information systems, the required functions will need to be incorporated at different parts of the information system including terminals/computers, services, network management to cryptographic devices, smart cards, public and private keys, etc. Some of these can be expected to be embedded in the hardware or software provided by vendors, while others may be part of distributed systems (e.g. network management), in the possession of the individual user (e.g. smart cards) or provided from a specialized organization (e.g. public/private keys). Most of the security products and services can be expected to be provided by vendors, service providers or operators. For specific functions, e.g. the provision of public/private keys, auditing authorization, there may be the need to identify and mandate appropriate organizations. The same applies for certification, evaluation and verification of quality of service which are functions which need to be addressed by organizations independent of the interests of vendors, service providers or operators. These organizations could be private, governmental, or licensed by government to perform delegated functions. 6.2. Objective In order to facilitate a harmonious development of the provision of security of information systems in the Community for the protection of the public and of business interests, it will be necessary to develop a consistent approach as to its provision of security. Where independent organizations will have to be mandated, their functions and conditions will need to be defined and agreed and, where required, embedded into the regulatory framework. The -objective would be to come to a clearly defined and agreed sharing of responsibilities between the different actors on a Community level as a prerequisite for mutual recognition. 6.3. Status and trends At present, the provision of security of information systems is well organized only for specific areas and limited to addressing their specific needs. The organization on a European level is mostly informal, and mutual recognition of verification and certification is not yet established outside closed groups. With the growing importance of the security of information systems, the need for defining a consistent approach to the provision of security for information systems in Europe and internationally is becoming urgent. 6.4. Requirements, options and priorities Because of the number of different actors concerned and the close relations to regulatory and legislative questions, it is particularly important to pre-agree on the principles which should govern the provision of the security of information systems. In developing a consistent approach to this question, one will need to address the aspects of identification and specification of functions requiring, by their very nature, the availability of some independent organizations (or inter-working organizations). This could include functions such as the administration of a public/private key system. In addition, it is required to identify and specify, at an early stage, the functions which in the public interest need to be entrusted to independent organizations (or interworking organizations). This could, for example, include auditing, quality assurance, verification, certification and similar functions.

Summary: Information security Information security The complexity of the security of information systems calls for the development of strategies to enable the free movement of information whilst ensuring the security of the use of information systems throughout the Community. The decision in question is intended to create a plan of action in the area of information security, as well as a committee responsible for advising the Commission of any actions to be taken in this area. ACT Council Decision 92/242/EEC of 31 March 1992 in the field of information security. SUMMARY This decision approves action in the field of security of information systems. This action includes two components: setting up an action plan for an initial 24-month period. An amount of ECU 12 million is considered necessary to implement the action for an initial period of twenty-four months; setting up a Senior Officials Committee with a long-term mandate to advise the Commission on action to be undertaken in the field of the security of information systems. Action Plan The action plan shall have as its objective the development of overall strategies aiming to provide users and producers of electronically stored, processed or transmitted information with appropriate protection of information systems against accidental or deliberate threats. The action plan shall be implemented in close collaboration with the sector actors. It shall take into account and complement the world-wide standardisation activities under way in this field. It shall include the following lines of action: development of an information security strategy framework; identification of user and service provider requirements for the security of information systems; solutions for immediate and interim needs of users, suppliers and service providers; specifications, standardisation and verification of information security; technological and operational developments for information security within a general strategy; provision of security of information systems. Details of the action plan are set out in the annex to the Decision. Committee The Committee is consulted by the Commission systematically on issues relating to the security of the information systems for the various activities carried out by the Community, in particular on the definition of work strategies and programmes. References Act Entry into force Deadline for transposition in the Member States Official Journal Decision 92/242/EC 31.03.1992 - OJ L 123 of 31.03.1992 RELATED ACTS COMBATING COMPUTER-RELATED CRIME Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information systems [Official Journal L 69 16.03.2005]. This framework decision aims to strengthen judicial cooperation on criminal matters relating to attacks against information systems by developing tools and effective procedures. Communication of the Commission to the Council, the European Parliament, the Economic and Social Committee and the Committee of the Regions: creating a Safer Information Society by Improving the Security of Information Infrastructures and Combating Computer-related Crime [COM(2000) 890 final - not published in the Official Journal]. EUROPEAN NETWORK AND INFORMATION SECURITY AGENCY (ENISA) Regulation (EC) No 460/2004 of the European Parliament and of the Council of 10 March 2004 establishing the European Network and Information Security Agency. In order to guarantee the highest degree of security to users, the EU is equipped with a European network and information security agency ENISA.The aim of creating ENISA first and foremost is to enhance the ability of the Union, the Member States and the business sector to address and to respond to network and information security problems. See also For further information on measures employed to ensure security in an information society, please consult the Commission's web site on Europe's Information Society. Last updated: 12.09.2005


29.7.1991 EN Official Journal of the European Communities L 206/19 COUNCIL DIRECTIVE of 25 June 1991 supplementing the measures to encourage improvements in the safety and health at work of workers with a fixed-duration employment relationship or a temporary employment relationship (91/383/EEC) THE COUNCIL OF THE EUROPEAN COMMUNITIES, Having regard to the Treaty establishing the European Economic Community, and in particular Article 118a thereof, Having regard to the proposal from the Commission (1), In cooperation with the European Parliament (2), Having regard to the opinion of the Economic and Social Committee (3), Whereas Article 118a of the Treaty provides that the Council shall adopt, by means of Directives, minimum requirements for encouraging improvements, especially in the working environment, to guarantee a better level of protection of the safety and health of workers; Whereas, pursuant to the said Article, Directives must avoid imposing administrative, financial and legal constraints which would hold back the creation and development of small and medium-sized undertakings; Whereas recourse to forms of employment such as fixed-duration employment and temporary employment has increased considerably; Whereas research has shown that in general workers with a fixed-duration employment relationship or temporary employment relationship are, in certain sectors, more exposed to the risk of accidents at work and occupational diseases than other workers; Whereas these additional risks in certain sectors are in part linked to certain particular modes of integrating new workers into the undertaking; whereas these risks can be reduced through adequate provision of information and training from the beginning of employment; Whereas the Directives on health and safety at work, notably Council Directive 89/391/EEC of 12 June 1989 on the introduction of measures to encourage improvements in the safety and health of workers at work (4), contain provisions intended to improve the safety and health of workers in general; Whereas the specific situation of workers with a fixed-duration employment relationship or a temporary employment relationship and the special nature of the risks they face in certain sectors calls for special additional rules, particularly as regards the provision of information, the training and the medical surveillance of the workers concerned; Whereas this Directive constitutes a practical step within the framework of the attainment of the social dimension of the internal market, HAS ADOPTED THIS DIRECTIVE: SECTION I SCOPE AND OBJECT Article 1 Scope This Directive shall apply to: 1. employment relationships governed by a fixed-duration contract of employment concluded directly between the employer and the worker, where the end of the contract is established by objective conditions such as: reaching a specific date, completing a specific task or the occurence of a specific event; 2. temporary employment relationships between a temporary employment business which is the employer and the worker, where the latter is assigned to work for and under the control of an undertaking and /or establishment making use of his services. Article 2 Object 1. The purpose of this Directive is to ensure that workers with an employment relationship as referred to in Article 1 are afforded, as regards safety and health at work, the same level of protection as that of other workers in the user undertaking and/or establishment. 2. The existence of an employment relationship as referred to in Article 1 shall not justify different treatment with respect to working conditions inasmuch as the protection of safety and health at work are involved, especially as regards access to personal protective equipment. 3. Directive 89/391/EEC and the individual Directives within the meaning of Article 16 (1) thereof shall apply in full to workers with an employment relationship as referred to in Article 1, without prejudice to more binding and/or more specific provisions set out in this Directive. SECTION II GENERAL PROVISIONS Article 3 Provision of information to workers Without prejudice to Article 10 of Directive 89/391/EEC, Member States shall take the necessary steps to ensure that: 1. before a worker with an employment relationship as referred to in Article 1 takes up any activity, he is informed by the undertaking and/or establishment making use of his services of the risks which he faces; 2. such information: — covers, in particular, any special occupational qualifications or skills or special medical surveillance required, as defined in national legislation, and — states clearly any increased specific risks, as defined in national legislation, that the job may entail. Article 4 Workers' training Without prejudice to Article 12 of Directive 89/391/EEC, Member States shall take the necessary measures to ensure that, in the cases referred to in Article 3, each worker receives sufficient training appropriate to the particular characteristics of the job, account being taken of his qualifications and experience. Article 5 Use of workers' services and medical surveillance of workers 1. Member States shall have the option of prohibiting workers with an employment relationship as referred to in Article 1 from being used for certain work as defined in national legislation, which would be particularly dangerous to their safety or health, and in particular for certain work which requires special medical surveillance, as defined in national legislation. 2. Where Member States do not avail themselves of the option referred to in paragraph 1, they shall, without prejudice to Article 14 of Directive 89/391/EEC, take the necessary measures to ensure that workers with an employment relationship as referred to in Article 1 who are used for work which requires special medical surveillance, as defined in national legislation, are provided with appropriate special medical surveillance. 3. It shall be open to Member States to provide that the appropriate special medical surveillance referred to in paragraph 2 shall extend beyond the end of the employment relationship of the worker concerned. Article 6 Protection and prevention services Member States shall take the necessary measures to ensure that workers, services or persons designated, in accordance with Article 7 of Directive 89/391/EEC, to carry out activities related to protection from and prevention of occupational risks are informed of the assignment of workers with an employment relationship as referred to in Article 1, to the extent necessary for the workers, services or persons designated to be able to carry out adequately their protection and prevention activities for all the workers in the undertaking and/or establishment. SECTION III SPECIAL PROVISIONS Article 7 Temporary employment relationships: information Without prejudice to Article 3, Member States shall take the necessary steps to ensure that: 1. before workers with an employment relationship as, referred to in Article 1 (2) are supplied, a user undertaking and/or establishment shall specify to the temporary employment business, inter alia, the occupational qualifications required and the specific features of the job to be filled; 2. the temporary employment business shall bring all these facts to the attention of the workers concerned. Member States may provide that the details to be given by the user undertaking and/or establishment to the temporary employment business in accordance with point 1 of the first subparagraph shall appear in a contract of assignment. Article 8 Temporary employment relationships: responsibility Member States shall take the necessary steps to ensure that: 1. without prejudice to the responsibility of the temporary employment business as laid down in national legislation, the user undertaking and/or establishment is/are responsible, for the duration of the assignment, for the conditions governing performance of the work; 2. for the application of point 1, the conditions governing the performance of the work shall be limited to those connected with safety, hygiene and health at work. SECTION IV MISCELLANEOUS PROVISIONS Article 9 More favourable provisions This Directive shall be without prejudice to existing or future national or Community provisions which are more favourable to the safety and health protection of workers with an employment relationship as referred to in Article 1. Article 10 Final provisions 1. Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 31 December 1992 at the latest. They shall forthwith inform the Commission thereof. When Member States adopt these measures, the latter shall contain a reference to this Directive or shall be accompanied by such reference on the occasion of their official publication. The methods of making such a reference shall be laid down by the Member States. 2. Member States shall forward to the Commission the texts of the provisions of national law which they have already adopted or adopt in the field covered by this Directive. 3. Member States shall report to the Commission every five years on the practical implementation of this Directive, setting out the points of view of workers and employers. The Commission shall bring the report to the attention of the European Parliament, the Council, the Economic and Social Committee and the Advisory Committee on Safety, Hygiene and Health Protection at Work. 4. The Commission shall submit to the European Parliament, the Council and the Economic and Social Committee a regular report on the implementation of this Directive, due account being taken of paragraphs 1, 2 and 3. Article 11 This Directive is addressed to the Member States. Done, at Luxembourg, 25 June 1991 For the Council The President J.-C. JUNCKER (1) OJ No C 224, 8. 9. 1990, p. 4. (2) Opinion delivered on 20 November 1990 (not yet published in the Official Journal) and OJ No C 158, 17. 6. 1991. (3) OJ No C 332, 31. 12. 1990, p. 167 (4) OJ No L 183, 29. 6. 1989, p. 1.

Summary: Workplace health and safety for temporary workers Workplace health and safety for temporary workers SUMMARY OF: Council Directive 91/383/EEC of 25 June 1991 supplementing the measures to improve health and safety in the workplace of temporary workers WHAT IS THE AIM OF THIS DIRECTIVE? It aims to ensure that EU countries enact legislation to improve health and safety protection for workers on temporary* or fixed-term* contracts, to bring it in line with the protection enjoyed by other workers. KEY POINTS Council Directive 89/391/EEC on the safety and health of workers applies equally to temporary workers*. The current directive supplements this with the following: Information and training Before work begins, temporary workers should be informed of any risks in the job and, in particular, any special occupational qualifications, skills or special medical surveillance required. Each worker should receive sufficient job-appropriate training adapted to their level of qualifications and experience. Special medical surveillance Where work is particularly dangerous to the safety or health of temporary workers, or requires special medical surveillance, EU countries have the option to prohibit their use. If temporary workers are used for such work, appropriate special medical surveillance must be provided by the employer, which could extend beyond the period of employment, if necessary. Health and safetyservices Health and safety services within an organisation must be informed of any assignment of temporary workers. Employment businesses and agencies If temporary workers are supplied by an agency, or other employment business, the agency must be informed of the qualifications required and the specific features of the work, and this information must be passed on to the workers concerned. The information could form part of the contract of assignment. The organisation employing the temporary worker, however, is responsible for the safety, hygiene and health aspects of working conditions. Responsibility of EU countries EU countries must report to the European Commission every 5 years on its implementation, including the points of view of workers and employers. FROM WHEN DOES THE DIRECTIVE APPLY? It applies from 15 July 1991. EU countries had to incorporate it into national law by 31 December 1992. BACKGROUND For more information, see: Working Conditions — Health and Safety in Fixed-Term and Temporary Employment on the European Commission’s website Directive 91/383/EEC — fixed-duration or temporary employment relationship on the European Agency for Safety and Health at Work's website Summary of Council Directive 89/391/EEC on the introduction of measures to encourage improvements in the safety and health of workers at work. * KEY TERMS Temporary contract: an employment contract between a temporary employment business (such as an agency) and a worker, to carry out a task in an organisation under its supervision. Fixed-term (or fixed-duration) contract: an employment contract directly between an employer and a worker for a specific duration or to complete a specific task. Temporary worker: a term used for clarity in this summary to cover a person working under either of the 2 temporary employment relationships defined above. MAIN DOCUMENT Council Directive 91/383/EEC of 25 June 1991 supplementing the measures to encourage improvements in the safety and health at work of workers with a fixed-duration employment relationship or a temporary employment relationship (OJ L 206, 29.7.1991, pp. 19-21) Successive amendments to Directive 91/383/EEC have been incorporated in the basic text. This consolidated version is of documentary value only. RELATED DOCUMENTS Council Directive 89/391/EEC of 12 June 1989 on the introduction of measures to encourage improvements in the safety and health of workers at work (OJ L 183, 29.6.1989, pp. 1-8) See consolidated version. last update 01.12.2016


11.2.1989 EN Official Journal of the European Communities L 40/8 COUNCIL DIRECTIVE of 21 December 1988 relating to the transparency of measures regulating the pricing of medicinal products for human use and their inclusion in the scope of national health insurance systems (89/105/EEC) THE COUNCIL OF THE EUROPEAN COMMUNITIES, Having regard to the Treaty establishing the European Economic Community, and in particular Article 100a thereof, Having regard to the proposal from the Commission (1), In cooperation with the European Parliament (2), Having regard to the opinion of the Economic and Social Committee (3), Whereas marketing authorizations for proprietary medicinal products issued pursuant to Council Directive 65/65/EEC of 26 January 1965 on the approximation of provisions laid down by law, regulation or administrative action relating to proprietary medicinal products (4), as last amended by Directive 87/21/EEC (5), may be refused only for reasons relating to the quality, safety or efficacy of the proprietary medicinal products concerned; Whereas Member States have adopted measures of an economic nature on the marketing of medicinal products in order to control public health expenditure on such products; whereas such measures include direct and indirect controls on the prices of medicinal products as a consequence of the inadequacy or absence of competition in the medicinal products market and limitations on the range of products covered by national health insurance systems; Whereas the primary objective of such measures is the promotion of public health by ensuring the availability of adequate supplies of medicinal products at a reasonable cost; whereas, however, such measures should also be intended to promote efficiency in the production of medicinal products and to encourage research and development into new medicinal products, on which the maintenance of a high level of public health within the Community ultimately depends; Whereas disparities in such measures may hinder or distort intra-Community trade in medicinal products and thereby directly affect the functioning of the common market in medicinal products; Whereas the objective of this Directive is to obtain an overall view of national pricing arrangements, including the manner in which they operate in individual cases and all the criteria on which they are based, and to provide public access to them for all those involved in the market in medicinal products in the Member States; whereas this information should be public; Whereas, as a first step towards the removal of these disparites, it is urgently necessary to lay down a series of requirements intended to ensure that all concerned can verify that the national measures do not constitute quantitative restrictions on imports or exports or measures having equivalent effect thereto; whereas, however, these requirements do not effect the policies of those Member States which rely primarily upon free competition to determine the price of medicinal products; whereas these requirements also do not affect national policies on price setting and on the determination of social security schemes, except as far as it is necessary to attain transparency within the meaning of this Directive; Whereas the further harmonization of such measures must take place progressively, HAS ADOPTED THIS DIRECTIVE: Article 1 1. Member States shall ensure that any national measure, whether laid down by law, regulation or administrative action, to control the prices of medicinal products for human use or to restrict the range of medicinal products covered by their national health insurance systems complies with the requirements of this Directive. 2. The definition of ‘medicinal products’ laid down in Article 1 of Directive 65/65/EEC shall apply to this Directive. 3. Nothing in this Directive shall permit the marketing of a proprietary medicinal product in respect of which the authorization provided for in Article 3 of Directive 65/65/EEC has not been issued. Article 2 The following provisions shall apply if the marketing of a medicinal product is permitted only after the competent authorities of the Member State concerned have approved the price of the product: 1. Member States shall ensure that a decision on the price which may be charged for the medicinal product concerned is adopted and communicated to the applicant within 90 days of the receipt of an application submitted, in accordance with the requirements laid down in the Member State concerned, by the holder of a marketing authorization. The applicant shall furnish the competent authorities with adequate information. If the information supporting the application is inadequate, the competent authorities shall forthwith notify the applicant of what detailed additional information is required and take their final decision within 90 days of receipt of this additional information. In the absence of such a decision within the abovementioned period or periods, the applicant shall be entitled to market the product at the price proposed. 2. Should the competent authorities decide not to permit the marketing of the medicinal product concerned at the price proposed by the applicant, the decision shall contain a statement of reasons based on objective and verifiable criteria. In addition, the applicant shall be informed of the remedies available to him under the laws in force and the time limits allowed for applying for such remedies. 3. At least once a year, the competent authorities shall publish in an appropriate publication, and communicate to the Commission, a list of the medicinal products the price of which has been fixed during the relevant period, together with the prices which may be charged for such products. Article 3 Without prejudice to Article 4, the following provisions shall apply if an increase in the price of a medicinal product is permitted only after prior approval has been obtained from the competent authorities: 1. Member States shall ensure that a decision is adopted on an application submitted, in accordance with the requirements laid down in the Member State concerned, by the holder of a marketing authorization to increase the price of a medicinal product and communicated to the applicant within 90 days of its receipt. The applicant shall furnish the competent authorities with adequate information including details of those events intervening since the price of the medicinal product was last determined which in his opinion justify the price increase requested. If the information supporting the application is inadequate, the competent authorities shall forthwith notify the applicant of what detailed additional information is required and take their final decision within 90 days of receipt of this additional information. In case of an exceptional number of applications, the period may be extended once only for a further 60 days. The applicant shall be notified of such extension before the expiry of the period. In the absence of such a decision within the abovementioned period or periods, the applicant shall be entitled to apply in full the price increase requested. 2. Should the competent authorities decide not to permit the whole or part of the price increase requested, the decision shall contain a statement of reasons based on objective and verifiable criteria and the applicant shall be informed of the remedies available to him under the laws in force and the time limits allowed for applying for such remedies. 3. At least once a year, the competent authorities shall publish in an appropriate publication and communicate to the Commission, a list of the medicinal products for which price increases have been granted during the relevant period, together with the new price which may be charged for such products. Article 4 1. In the event of a price freeze imposed on all medicinal products or on certain categories of medicinal products by the competent authorities of a Member State, that Member State shall carry out a review, at least once a year, to ascertain whether the macro-economic conditions justify that the freeze be continued unchanged Within 90 days of the start of this review, the competent authorities shall announce what increases or decreases in prices are being made, if any. 2. In exceptional cases, a person who is the holder of a marketing authorization for a medicinal product may apply for a derogation from a price freeze if this is justified by particular reasons. The application shall contain an adequate statement of these reasons. Member States shall ensure that a reasoned decision on any such application is adopted and communicated to the applicant within 90 days. If the information supporting the application is inadequate, the competent authorities shall forthwith notify the applicant of what detailed additional information is required and take their final decision within 90 days of receipt of this additional information. Should the derogation be granted, the competent authorities shall forthwith publish an announcement of the price increase allowed. Should there be an exceptional number of applications, the period may be extended once only for a further 60 days. The applicant shall be notified of such extension before the expiry of the initial period. Article 5 Where a Member State adopts a system of direct or indirect controls on the profitability of persons responsible for placing medicinal products on the market, the Member State concerned shall publish the following information in an appropriate publication and communicate it to the Commission: (a) the method or methods used in the Member State concerned to define profitability: return on sales and/or return on capital; (b) the range of target profit currently permitted to persons responsible for placing medicinal products on the market in the Member State concerned; (c) the criteria according to which target rates of profit are accorded to an individual responsible for placing medicinal products on the market, together with the criteria according to which they will be allowed to retain profits above their given targets in the Member State concerned; (d) the maximum percentage profit which any person responsible for placing medicinal products on the market is allowed to retain above his target in the Member State concerned. This information shalhbe updated once a year or when significant changes are made. Where, in addition to operating a system of direct or indirect controls on profits, a Member State operates a system of controls on the prices of certain types of medicinal products which are excluded from the scope of the profit control scheme, Articles 2, 3 and 4 shall, where relevant, apply to such price controls. However, the said Articles shall not apply where the normal operation of a system of direct or indirect controls on profits results exceptionally in a price being fixed for an individual medicinal product. Article 6 The following provisions shall apply if a medicinal product is covered by the national health insurance system only after the competent authorities have decided to include the medicinal product concerned in a positive list of medicinal products covered by the national health insurance system. 1. Member States shall ensure that a decision on an application submitted, in accordance with the requirements laid down in the Member State concerned, by the holder of a marketing authorization to include a medicinal product in the list of medicinal products covered by the health insurance systems is adopted and communicated to the applicant within 90 days of its receipt. Where an application under this Article may be made before the competent authorities have agreed the price to be charged for the product pursuant to Article 2, or where a decision on the price of a medicinal product and a decision on its inclusion within the list of products covered by the health insurance system are taken after a single administrative procedure, the time limit shall be extended for a further 90 days. The applicant shall furnish the competent authorities with adequate information. If the information supporting the application is inadequate, the time limit shall be suspended and the competent authorities shall forthwith notify the applicant of what detailed additional information is required. Where a Member State does not permit an application to be made under this Article before the competent authorities have agreed the price to be charged for the product pursuant to Article 2, the Member State concerned shall ensure that the overall period of time taken by the two procedures does not exceed 180 days. This time limit may be extended in accordance with Article 2 or suspended in accordance with the provisions of the preceding subparagraph. 2. Any decision not to include a medicinal product in the list of products covered by the health insurance system shall contain a statement of reasons based upon objective and verifiable criteria, including, if appropriate, any expert opinions or recommendations on which the decision is based. In addition, the applicant shall be informed of the remedies available to him under the laws in force and of the time limits allowed for applying for such remedies. 3. Before the date referred to in Article 11 (1), Member States shall publish in an appropriate publication and communicate to the Commission the criteria which are to be taken into account by the competent authorities in deciding whether or not to include medicinal products on the lists. 4. Within one year of the date referred to in in Article 11(1), Member States shall publish in an appropriate publication and communicate to the Commission a complete list of the products covered by their health insurance system, together with their prices fixed by the national competent authorities. This information shall be updated at least once every year. 5. Any decision to exclude a product from the list of products covered by the health insurance system shall contain a statement of reasons based on objective and verifiable criteria. Such decisions, including, if appropriate, any expert opinions or recommendations on which the decisions are based, shall be communicated to the person responsible, who shall be informed of the remedies available to him under the laws in force and the time limits allowed for applying for such remedies. 6. Any decision to exclude a category of medicinal products from the list of products covered by the health insurance system shall contain a statement of reasons based on objective and verifiable criteria and be published in an appropriate publication. Article 7 The following provisions shall apply if the competent authorities of a Member State are empowered to adopt decisions to exclude individual or categories of medicinal products from the coverage of its national health insurance system (negative lists). 1. Any decision to exclude a category of medicinal products from the coverage of the national health insurance system shall contain a statement of reasons based upon objective and verifiable criteria and be published in an appropriate publication. 2. Before the date referred to in Article 11 (1), Member States shall publish in an appropriate publication and communicate to the Commission the criteria which are to be taken into account by the competent authorities in deciding whether or not to exclude an individual medicinal product from the coverage of the national health insurance system. 3. Any decision to exclude an individual medicinal product from the coverage of the national health insurance system shall contain a statement of reasons based on objective and verifiable criteria. Such decisions, including, if appropriate, any expert opinions or recommendations on which the decisions are based, shall be communicated to the person responsible, who shall be informed of the remedies available to him under the laws in force and the time limits allowed for applying for such remedies. 4. Within one year of the date referred to in Article 11 (1), the competent authorities shall publish in an appropriate publication and communicate to the Commission a list of the individual medicinal products which have been excluded from the scope of its health insurance system. This information shall be updated at least every six months. Article 8 1. Before the date referred to in Article 11 (1), Member States shall communicate to the Commission any criteria concerning the therapeutic classification of medicinal products which are used by the competent authorities for the purposes of the national social security system. 2. Before the date referred to in Article 11 (1), Member States shall communicate to the Commission any criteria which are used by the competent authorities in verifying the fairness and transparency of the prices charged for transfers within a group of companies of active principles or intermediate products used in the manufacture of medicinal products or finished medicinal products. Article 9 1. In the light of experience, the Commission shall, not later than two years after the date referred to in Article 11(1), submit to the Council a proposal containing appropriate measures leading towards the abolition of any remaining barriers to, or distortions of, the free movement of proprietary medicinal products, so as to bring this sector closer into line within the normal conditions of the internal market. 2. The Council shall decide on the Commission proposal not later than one year after its submission. Article 10 1. A Committee called the ‘Consultative Committee for the implementation of Directive 89/105/EEC relating to the transparency of measures regulating the pricing of medicinal products for human use and their inclusion in the scope of national health insurance systems’ shall be set up and attached to the Commission. 2. The tasks of the committee shall be to examine any question relating to the application of this Directive which is brought up by the Commission or at the request of a Member State. 3. The committee shall consist of one representative from each Member State. There shall be one deputy for each representative. This deputy shall be entitled to participate in meetings of the committee. 4. A representative of the Commission shall chair the committee. 5. The committee shall adopt its rules of procedure. Article 11 1. Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 31 December 1989 at the latest. They shall forthwith inform the Commission thereof. 2. Before the date referred to in paragraph 1, Member States shall communicate to the Commission the texts of any laws, regulations or administrative provisions relating to the pricing of medicinal products, the profitability of manufacturers of medicinal products and the coverage of medicinal products by the national health insurance system. Amendments and modifications to these laws, regulations or administrative provisions shall be communicated to the Commission forthwith. Article 12 This Directive is addressed to the Member States. Done at Brussels, 21 December 1988. For the Council The President V. PAPANDREOU (1) OJ No C 17, 23. 1. 1987, p. 6 and OJ No C 129, 18. 5. 1988, p. 14. (2) OJ No C 94, 11. 4. 1988, p. 62 and OJ No C 326, 19. 12. 1988. (3) OJ No C 319, 30. 11. 1987, p. 47. (4) OJ No 22, 9. 2. 1965, p. 369/65. (5) OJ No L 15, 17. 1. 1987, p. 36.

Summary: Transparency of decisions regulating the prices and the reimbursement of medicinal products in EU countries Transparency of decisions regulating the prices and the reimbursement of medicinal products in EU countries SUMMARY OF: Directive 89/105/EEC on the transparency of measures regulating the prices of medicines for human use and their inclusion in the scope of national health insurance systems WHAT IS THE AIM OF THE DIRECTIVE? It aims to ensure that any measures taken by EU countries to set the prices of and to reimburse medicinal products are transparent. To achieve this, it sets out the procedures that EU countries must follow so that their decisions and policies do not create obstacles to the EU pharmaceutical trade. KEY POINTS EU countries’ national authorities, once a medicine is authorised, must: make a decision on the price charged and the level of reimbursement within 90 days of receiving an application, providing all the necessary information has been supplied; allow an applicant to sell the product at the price proposed, if they fail to take a decision within the 90-day deadline; provide reasons based on objective and verifiable criteria for any refusal to authorise the price of a medicine; follow largely the same procedures when considering applications: for an increase in the price of a medicine, for an exemption from a price freeze, or for inclusion on the list of products covered by national health insurance systems; review at least once a year any price freeze which may be imposed on all medicines or certain categories of medicines to determine whether it is still justified by economic conditions; inform the European Commission of the terms of any direct or indirect controls they place on the profitability of pharmaceutical companies; allow decisions to be appealed before a national court and inform an applicant about the procedural requirements of those appeals. A consultative committee, known as the Transparency Committee, consisting of national representatives and chaired by the Commission, is responsible for considering any discussing any problem related to the implementation of the directive. FROM WHEN DOES THE DIRECTIVE APPLY? It has applied since 27 December 1988. EU countries had to incorporate it into national law by 31 December 1989. BACKGROUND After conducting a review of the legislation, the Commission proposed a new directive in March 2012. This aimed to streamline procedures and reduce the time taken by national decisions on the pricing and reimbursement of medicines. The legal proposal aimed at simplification of procedures as well as at improving the legal clarity and certainty for all interested parties The proposal was subsequently withdrawn by the Commission in March 2015. The Court of Justice of the European Union has handed down several judgments on the interpretation and implementation of the transparency legislation. For more information, see: ‘Transparency Directive’ on the European Commission’s website. MAIN DOCUMENT Council Directive 89/105/EEC of 21 December 1988 relating to the transparency of measures regulating the prices of medicinal products for human use and their inclusion in the scope of national health insurance systems (OJ L 40, 11.2.1989, pp. 8–11) last update 23.08.2016


EUR-Lex - 31987H0598 - EN Avis juridique important | 31987H0598 87/598/EEC: Commission Recommendation of 8 December 1987 on a European Code of Conduct relating to electronic payment (Relations between financial institutions, traders and service establishments, and consumers) Official Journal L 365 , 24/12/1987 P. 0072 - 0076 *****COMMISSION RECOMMENDATION of 8 December 1987 on a European Code of Conduct relating to electronic payment (Relations between financial institutions, traders and service establishments, and consumers) (87/598/EEC) THE COMMISSION OF THE EUROPEAN COMMUNITIES, Having regard to the Treaty establishing the European Economic Community, and in particular the second indent of Article 155 thereof, Whereas in the White Paper on completing the internal market the Commission undertook to formulate proposals with a view to adapting innovations and laws relating to new means of payment to the dimensions of that market; Whereas on 12 January 1987 the Commission sent to the Council the communication 'Europe could play an ace: the new payment cards' (1), Whereas, since there is a close link between technological development and the unification of the internal market, electronic payment should contribute to the rapid modernization of banking services, distribution and the telecommunications and information industries; Whereas consumers are entitled to except definite advantages from such a development; Whereas Community action should add to this the benefit of a large market; Whereas the development of new means of payment is to be seen in the context of the Community's financial and monetary integration and the extension of a people's Europe; Whereas the free movement of goods and capital will be fully effective only if it enjoys the technological support provided by the new means of payment; Whereas such means should be made available to economic partners in comparable circumstances in all Member States, although the Commission is aware that the development of payment cards (that is, payment cards incorporating a magnetic strip and/or a microcircuit) can vary in importance, depending on the Member State concerned, and that alternative forms of payment do exist; Whereas it is necessary to cooperate in order to arrive at standards and implementing rules which will make it possible, in the interests of users in the Community, for payment systems to be compatible and complementary; Whereas certain general principles should be established concerning fair practice in relations between financial institutions (i.e. banks and credit institutions), traders and service establishments, and card-holding consumers; Whereas establishment of such principles will favour rapid and effective application of the new technology; Whereas the heterogeneous, uncoordinated development of such technology should not diminish the opportunity which the technology itself affords of achieving the desired objective of compatible electronic payment systems within the Community; Whereas compatible cards and interconnected Community networks are essential prerequisites for mutually accessible systems and harmonized rules of use; Whereas, although it is for the banks and the other financial institutions concerned to decide to make systems compatible, the Commission is responsible for seeing that progress in this direction does not conflict with free competition within the Community market; Whereas it is clear that to try now, at Community level, to produce a rigid, detailed definition of the operation of systems in the midst of change might result in the establishment of rules that would be rapidly overtaken by developments, even constituting obstacles to electronic development; whereas this in no way prejudices the benefits of laying down the basic principles of consumer protection in this area; Whereas, nevertheless, it is appropriate that the Commission should see, at the present stage, that all changes in this sphere take place in accordance with the Treaty's rules and that it should seek, in the Community's interest, to establish and promote consensus as regards development of such systems; Whereas the fact that this new technology is not being developed on a large scale in any of the Member States makes it impossible as yet to determine with any accuracy all the specific problems that are likely to arise in particular as networks are completed and arrangements for the use of the new means of payment are finalized; Whereas, for these reasons, an instigative approach such as a code of conduct must be flexible so as to make it easier to adapt to changes in the new technology, HEREBY RECOMMENDS that all the economic partners concerned should comply with the provisions of the European Code of Conduct relating to electronic payment, as set out in the following. (1) COM(86) 754 final. EUROPEAN CODE OF CONDUCT RELATING TO ELECTRONIC PAYMENT I. OBJECTIVE 1. The Code sets out the conditions which should be fulfilled if the new, electronic means of payment are to be developed for the benefit of all economic partners and are to afford: - for consumers, security and convenience, - for traders and issuers, greater security and productivity, - for industry in the Community, a leading market. 2. The principles of fair practice must be observed by all those who bring card payment systems into operation or make use of them. 3. The technological development of electronic means of payment should have an eye to their European dimension: such means must be as widely interoperable as possible, to avoid having isolated systems and, hence, a partitioned market. II. DEFINITIONS For the purposes of this Code: 1. 'Electronic payment' means any payment transaction carried out by means of a card incorporating a magnetic strip or microcircuit used at an electronic payment terminal (EPT) or point-of-sale (POS) terminal. The Code does not cover: - 'company-specific' cards not covered by the above definition, - cards serving purposes other than direct or deferred payment, - payments by cheque with bank-card guarantee, - payments by card using mechanical processes (invoice slips). 2. 'Issuer' means any banking or credit institution issuing a payment card for electronic use, plus any production or service undertaking which can also issue such a card. 3. 'Trader' means distributive trading or service establishment. 4. 'Consumer' means cardholder. 5. 'Interoperability' means a state of affairs whereby cards issued in one Member State and/or belonging to a given card system can be used in other Member States and/or in the networks installed by other systems. This requires that the cards and readers used in the various systems must be technologically compatible and that systems must be opened up by means of reciprocity agreements. III. GENERAL PRINCIPLES 1. Contracts (a) Contracts concluded by issuers, or their agents, with traders and consumers shall be in writing and must be the result of a prior application. They shall set out in detail the general and specific conditions of the agreement. (b) They shall be drawn up in the official language(s) of the Member State in which the contract is concluded. (c) Any scale of charges must be determined in a transparent manner, taking account of actual costs and risks and without involving any restriction of competition. (d) All conditions, provided they are in conformity with the law, shall be freely negotiable and clearly stipulated in the contract. (e) Conditions specific to termination of a contract must be stated and brought to the notice of the parties prior to such contract being concluded. 2. Interoperability By a given date (1), interoperability, in the Comunity at any rate, should be full and complete, so that traders and consumers can join the network(s) or contract with the issuer(s) of their choice, with each terminal being able to process all cards. 3. Equipment (a) Electronic payment terminals are required to register, control and transmit payments and may be integrated into a point-of-sale terminal. (b) Traders must be able, if they wish, to install a single, multi-card-terminal. (c) Traders must be free to choose which point-of-sale terminal they will install. They must be at liberty either to rent or purchase such equipment, provided only that it is certified as satisfying the requirements of the whole payment system and can be used on an interoperable basis. 4. Data protection and security (a) Electronic payments are irreversible. An order given by means of a payment card shall be irrevocable and may not be countermanded. (b) The information transmitted, at the time of payment, to the trader's bank and subsequently to the issuer must not in any circumstances prejudice the protection of privacy. It shall be strictly limited to that normally laid down for cheques and transfers. (c) Any problems whatsoever that arise in connection with the protection of information or with security must be openly acknowledged and cleared up at whatever stage in the contract between the parties. (d) Contracts must not restrict trader's freedom of operation or freedom to compete. 5. Fair access to the system (a) Irrespective of their economic size, all service establishments concerned must be allowed fair access to the system of electronic payment. A trader may be refused access for a legitimate reason only. (b) There must be no unwarranted difference in the remuneration for services concerning transactions within one Member State and the remuneration for the same services concerning transnational transactions with other Community countries, especially in border regions. IV. SUPPLEMENTARY PROVISIONS 1. Relations between issuers and traders (a) To promote mutual access among different card systems, contracts between card issuers and traders must contain no exclusive trading clause requiring the trader to operate only the system with which he has contracted an agreement. (b) Contracts with traders must admit effective competition between the various issuers. Compulsory provisions must be limited strictly to technical requirements for ensuring that the system functions properly. 2. Relations between issuers and consumers Cardholders shall take all reasonable precautions to ensure the safety of the card issued and shall observe the special conditions (loss or theft) in the contract which they have signed. 3. Relations between traders and consumers Traders shall display, in a fully visible manner, the signs of the companies to which they are affiliated; they shall be obliged to accept such cards. Done at Brussels, 8 December 1987. For the Commission COCKFIELD Vice-President (1) 31 December 1992, i.e. the date by which the internal market must be complete.

Summary: Electronic payment: code of conduct Electronic payment: code of conduct Standardisation of payment card systems in order to guarantee access for all electronic card-holders to the various distribution networks. ACT Commission Recommendation 87/598/EEC of 8 December 1987, concerning a European code of conduct relating to electronic payments [Official Journal L 365 of 24.12.1987]. SUMMARY Recommendation that all interested parties concerned should comply with the provisions of the "European code of conduct" relating to electronic payments. This has been drafted by the European Commission and will promote: security and convenience for consumers; greater security and efficiency for traders and issuers. Definitions of "electronic payment", "issuer" (bank), "trader", "consumer" and "interoperability". General principles relating to the contract between issuers (banks) and traders or consumers, e.g. it shall set out in detail the general and specific conditions of the agreement; the contract shall be drawn up in the official language(s) of the Member State in which it is concluded. Commission recommendation that interoperability be full and complete before 31 December 1992. This will enable traders and consumers to join the networks or contract with the issuers of their choice, and ensure that every electronic payment terminal is able to process all cards. Respect of privacy of information given by consumer. Right of fair access to the system for traders, irrespective of their size. Obligations concerning relations between issuers and traders: including a ban on any exclusive trading clause which requires the trader to operate only one system, and an obligation on card-holders to take all reasonable precautions to ensure the safety of the payment card. RELATED ACTS The Commission adopted two new recommendations in this field in 1988 and 1997. The first concerned relations between card-holders and card-issuers while the second concerned electronic payment. Last updated: 20.05.2005