G/TBT/W/633  
 
8 April  2019 
(19-2253) Page: 1/2 
Committee on Technical Barriers to Trade  Original: English  
 
CHINA - REQUIREMENTS  FOR INFORMATION SEC URITY PRODUCTS, INCL UDING, INTER 
ALIA , THE OFFICE OF STAT E COMMERCIAL CRYPTOG RAPHY ADMINISTRATION  (OSCCA) 
1999 REGULATION ON C OMMERCIAL ENCRYPTION  PRODUCTS AND ITS ON -GOING 
REVISION AND THE MUL TI-LEVEL PROTECTION SCHEME (MLPS)  
STATEMENT BY THE EUROPEAN UNION TO THE COMMITTEE ON TECHNICAL BARRIERS T O TRADE  
6 AND 7  MARCH  2019 
The following communication, dated 5 April  2019, is being circulated at the request of the delegation 
of the European Union . 
_______________  
1.  The European Union would like to reiterate the importance of clarifying the implications of the 
adoption and entry into force of China's new Cybersecurity Law for the existing rules, notably the 
Multi Level Protection Scheme ('MLPS').  
2.  The EU would like to re call the comments it has recently submitted on the draft "Guidelines for 
grading of classified cybersecurity protection", and repeated several times in this Committee, 
including on de facto  exclusion of foreign -invested vendors as a result of protection le vel three and 
above under the established MLPS.  Together with the wide scope of application of protection level 
three and above under the established MLPS, this has led to unwarranted and significant market 
entry restriction.  The EU's main concerns with re gard to the Guidelines are i) the further extension 
in scope of protection level three and above, ii) the nature of the expert review that the Guidelines 
prescribe, as well as (iii) a lack of clarify in certain definitions.  
3.  The EU calls for enhanced propo rtionality and transparency in the implementation of the Cyber 
Multi-Level Protection Scheme, instead of introducing overly burdensome requirements and 
broadening the scope of Level 3 networks. The EU has noticed that due to the ambiguity of self -
assessmen t rules for all levels, especially assessments at levels 3 and above, this translates in a de 
facto closure of markets for EU companies.  
4.  The lack of access to relevant Chinese Standards Developing Organizations becomes particularly 
pressing with regard to  the Cyber -MLPS, which will draw heavily on a number of mandatory and 
recommended standards to be developed by these standardization bodies.  In particular, the EU 
notes with concern that several Working Groups, notably Working Group 3 on encryption of the 
TC260 standards development organization, remain closed to European industry representatives, as 
those who applied still have not received answers. Similarly, the related industry -level 
standardisation body, the Cryptography Standardisation Technical Commi ttee (CSTC) has, to our 
knowledge, no single foreign industry participant.  The EU therefore calls once again for the State 
Cryptography Administration (SCA) to make information accessible to all industry stakeholders, 
including EU -invested enterprises regi stered in China, which should also be able to participate in the 
formulation of said standards and specifications on an equal basis. We would also like to request 
that stakeholders be informed in advance about the entering into force of these measures.  
5.  The EU also seeks clarification on whether the new Cyber -MLPS replaces the old one. Some of 
the standards developed to implement it suggest this, but there has been no official announcement 
on this.  More generally, the key provisions and concepts leave consi derable room for interpretation. 
The Regulation also refers in several articles to a number of standards, some of which are still to be 
developed, without however giving any further specifications. Also, various different governmental G/TBT/W/633  
 
- 2 - 
 
  authorities are being  referred to throughout the Regulation with at times no clear guidance as to 
which authority specifically is deemed competent to rule on the matter at hand. Taken together, the 
EU believes these points unnecessarily introduce complexity, costs and complian ce risks. The EU 
encourages cross -ministerial coordination on cybersecurity legislation and standardisation.  
6.  Finally, we ask that China confirms whether the revised draft will be notified to the WTO for 
comments. The EU recalls the importance of allowing f or adequate participation of interested parties 
in domestic processes.  
__________