G/TBT/W/656  
 
18 July 2019  
(19-4777) Page: 1/2 
Committee on Technical Barriers to Trade  Original: English  
 
CHINA - DRAFT REVISE D ENCRYPTION LAW OF THE PEOPLE'S REPUBLI C OF CHINA BY 
THE OFFICE OF STATE COMMERCIAL CRYPTOGRA PHY ADMINISTRATION ( OSCCA)  
STATEMENT BY THE EUR OPEAN UNION TO THE C OMMITTEE ON TECHNICA L BARRIERS TO TRADE  
20 AND 21 JUNE 2019  
The following communication, dated 17 July 2019, is being circulated at the request of the delegation 
of the European Union . 
 
_______________  
 
 
1.  The EU would like to reiterate its concern on the draft Cryptography Law published by the Office 
of State Commer cial Cryptography Administration (OSCCA). We understand that the draft 
Cryptography law will be one of 13 pieces of legislation to be proposed for deliberation to the National 
People's Congress Standing Committee this year. Therefore, the EU would like to follow -up on the 
written comments it has submitted to the public consultation and repeated several times in this 
Committee, and would like to once again hig hlight certain concerns. We would also appreciate 
getting more information on the timetable envisage d for the deliberation of this draft.  
2.  The EU is concerned about the risk -based approach taken in the draft law. We understand this 
aims to reduce the number of e -crime incidents, but it will also affect the daily operations of EU 
companies.  
3.  The EU is conc erned about the use of encryption products because the draft law is also very 
broad in scope and appears to try to regulate all uses of cryptography. Its scope of application for 
ICT products and services far exceeds those primarily dedicated to encryption . 
4.   The EU reiterates its concern on the draft law 's approach, which is based on an administrative 
license -focused cryptography regime; that is "regulation" for commercial cryptography, as per the 
following:  
a. It imposes a licensing scheme on the sale, use, i mport and export of commercial 
cryptography.  
b. It seems to depart from international practice, as well as previous commitments by China, 
including the March 2000 Clarification by OSCCA. According to these commitments, 
ICT products would not be subject to li censing requirements and similar regulatory 
constraints, unless the core function of the products is encryption. However, the draft law 
potentially captures a much wider range of products subjecting them to restrictions. The 
EU's industry active in cryptog raphy and semiconductors notes a risk of a regression. The 
new draft Cryptography Law has no longer any such restriction. In fact, it appears to be 
very broad in scope and used concepts such as "common", "commercial" or "core" 
encryption that should be fur ther defined.  
c. It foresees a pre -market approval obligation for commercial cryptographic products. This 
requirement is cumbersome and is a departure from international practice. More generally, 
we wonder whether the Law 's underlying approach, which is relyi ng on ex -ante pre -market 
approvals, can do justice to a dynamic and continuously innovating industry. The EU would 
welcome more precise information about the government body entrusted with this G/TBT/W/656  
 
- 2 - 
 
  function, the detailed procedure for import licences and the d etailed security concerns of 
equipment.  
d. It mandates "classified and graded assessments for the security of cryptographic 
applications in Critical Information Infrastructure (CII)"  
e. The EU is also concerned that these regulatory requirements related to marke t access are 
discriminatory, are not technology neutral, and lead to the forced transfer of intellectual 
property (e.g. by requiring mandatory disclosure of encryption keys).  
5.  The EU would welcome the explanation about the selection of sectors China has id entified as 
Critical Information Infrastructure, many of which have actually no impact on national security or 
even public order.  
6.  Finally, the EU is of the opinion that the draft does not recognise the key role of international 
standards in ensuring global  interoperability in the area of cryptography.  
7.  The EU kindly requests China to take these comments into account and modify the draft law 
accordingly.  
__________