G/TBT/W/637  
 
9 April 2019 
(19-2261) Page: 1/2 
Committee on Technical Barriers to Trade  Original: English  
 
CHINA - CYBERSECURIT Y LAW  
STATEMENT BY THE EUROPEAN UNION TO THE COMMITTEE ON TECHNICAL BARRIERS T O TRADE  
6 AND 7  MARCH  2019 
The following communication, dated 5 April  2019, is being circulated at the request of the delegation 
of the European Union .  
 
_______________  
 
 
1.  The EU  would like to reiterate its concerns with regard to the entry into force of the Cybersecurity 
Law on 1 June 2017.  
2.  The scope of the requirements is unclear, as key terms have not been specified in sufficient 
detail . Concepts such as "critical information infrastructure" and "secure and trustworthy products" 
are not sufficienty clarified . 
3.  The EU has concerns when it comes to the standard itself. We note that China released in 
September 2018 the final version of the s ecure and controllable standards .  
4.  We welcome the removal of reference to "source code" . However , we maintain  our concerns  
about the revised methodology. While references to source code have been removed from the final 
version, the mere requirement of prov iding "relevant materials " to verify the security and 
controllability of products, could very well imply source code disclosure.  
5.  The EU recalls the importance of international standards and notes that the law only make s 
references to national standards . This could lead to lack of interoperability with international 
standards. In the development of national standards, it would be appropriate to build on existing 
international standards and to in volve all relevant stakeholders, including foreign invested and  
wholly-foreign owned enterprises,  in a non -discriminatory manner in the relevant Techn ical 
Committees.  
6.  The EU would like to request  more clarity regarding several  of the implementing measures 
following China's Cybersecurity Law. For example,  the Cyberspa ce Administration of China's Cross -
Border Data Transfer Rules (Critical Information Infrastructure Protection Regulation and 
Administrative Measures on Security Assessment of Overseas Transfer of Personal Information and 
Important Data ) raise concerns about the broad scope of these regulations regarding what is 
considered  as critical information infrastructure and which kinds of cross -border data transfers are 
affected and ensuing legal uncertainty.  A definition of critical information appears  to cover many 
commercial activities and whole sectors that have no bearing on national security . Moreover, the list 
of what is considered important data is open -ended. A s a result of the data localisation and security 
assessment requirements, foreign comp anies operating in China could find themselves in a de facto 
less competitive situation compared to domestic operators in China . 
7.  As regards the certification and security rerquirements on critical information infrastructure, the 
EU is concerned that such r equirements lead to a de facto ban on products and services from fore ign-
invested enterprises provid ing products and services to businesses falling under the notion of "critical 
information infrastructure".  G/TBT/W/637  
 
- 2 - 
 
  8.  The EU calls on China to implement these provisi ons in a non -discriminatory manner, respecting 
the principles of proportionality, necessity and technology neutrality  and ensuring  adequate 
protection of intellectual property (IP).  Moreover, the EU would like to repeat  its previous requests 
for clarificat ions on the relationship with existing multi -level-protection systems (MLPs) and the 
expected timeline of implementation.  
9.  The EU notes with concern that the Cybersecurity law already applies and is enforceable 
(including possible fines and sanctions), whi le the implementing measures that would clarify its 
implementation are still not in place. The current situa tion creates significant  uncertainty for 
economic operators. Could China inform the Committee when implementing measures will be 
adopted?  
10.  The EU req uests  that China notifies  draft measures concerning  any sectoral implementation to 
the TBT Committee in order to give adequate opportunity for WTO Members and their stakeholders 
to comment on any subsequent developments.  
__________