G/TBT/W/480  
 
17 April 2018  
(18-2335) Page: 1/2 
Committee on Technical Barriers to Trade   Original: English  
 
CHINA — REQUIREMENTS FOR INF ORMATION SECURITY PR ODUCTS, INCLUDING, I NTER 
ALIA, THE OFFICE OF STATE COMMERCIAL CRY PTOGRAPHY ADMINISTRA TION (OSCCA) 
1999 REGULATION ON C OMMERCIAL ENCRYPTION  PRODUCTS AND ITS ON -GOING 
REVISION AND THE MUL TI-LEVEL PROTECTION SCH EME (MLPS);  
 
CHINA — BANKING IT EQUIPMENT  SECURITY REGULATION;   
 
CHINA — INSURANCE REGULATORY  COMMISSION (CIRC) IN FORMATION AND 
COMMUNICATION TECHNO LOGY REGULATION G/TBT/ N/CHN/1172  
STATEMENT BY THE EUR OPEAN UNION TO THE C OMMITTEE ON TECHNICA L BARRIERS TO TRADE  
21 AND 22 MARCH 2018  
The following communication, dated 16 April 2018, is being circulated at the request of the 
delegation of the European Union . 
 
_______________  
 
 
1.  The European Union reiterate s the importance of  clarifying the implications and con sequences 
of the adoption and entry into forc e of the new Cybersecurity Law for the existing rules, notably 
the MLPS and the OSCCA regulation on commercial encryption products . 
2.  The OSCCA regulation had been under review for many years and the European Unio n would 
appreciate  an update concerning both the timing of the review of the OSCCA regulation and the 
process for the overall review of the MLPS along with the OSCCA regulation to bring them in line 
with the new Cybersecurity Law.  
3.  The EU has recently submi tted comments on the draft "Guidelines for grading of classified 
cybersecurity protection, recalling that under the established Multi Level Protection Scheme 
("MLPS ") a grading into protection level three or above has led to the de facto exclusion of forei gn-
invested vendors; together with the wide scope of application of protection level three and above 
under the established MLPS this has led to unwarranted and significant market entry restriction.  
The EU's main concerns with regard to the Guidelines are t herefore i) the further extension in 
scope of protection level three and above, ii) the nature of the expert review that the Guidelines 
prescribe, as well as (iii) a lack of clarify in some definitions.   
4.  The EU would like to stress  the need for a transparent and predictable process for developing 
rules in the field of information security. The EU  welcome s the public consultations on certain draft 
rules but this is not yet systematic.  
5.  Moreover, the EU would like to recall  the importa nce of openness and accessibility of the 
standa rdization process in this field, considering that any third party assessment of products for 
the purpose of information security would be carried out according to mandatory standards.  
6.  In this respect the EU n otes that the key technical committee for information security (TC 260) 
still refuse s access to some foreign invested enterprises in China. The EU kindly requests China to 
notify draft measures in any subsequent sectoral implementation to the TBT Committee  in order to 
give adequate opportunity for WTO Members and their stakeholders to comment on any 
subsequent developments . G/TBT/W/480  
 
- 2 - 
 
  7.  Specifically on information security in the banking sector, the EU would appreciate an update 
by China on the status and expected timel ine of the possible revision of the Guideline for 
Promoting the Application of Secure and Controllable Information Technology in Banking Sector 
(2014 -2015) .  
8.  As for the rules applicable to the insurance sector, the EU reiterates its concerns regarding the 
draft insurance sector informatization rules , which have the effect of mandating insurance 
institutions in China to progressively phase out non -domestic cryptographic products. This would 
be tantamount to a ban on procuring foreign cryptography products co mpared with domestic 
products and would prevent insurance institutions from using the most developed and innovative 
encryption products and solutions which would have the unintended consequence of weakening 
rather than strengthening information and network  security.  
9.  The EU would like to recall that the concept of "secure and controllable", which is then also 
used in the National  Security Law and the Cybesecurity Law, lacks precision and create s 
uncertainty for economic operator.  
10.  In addition, the EU raised its concerns regarding the requirement that  insurance institutions 
obtain the ownership of  the source code of the equipment and the compulsary use of national 
standards and encryption requirements based on national algorithms. The EU would therefore 
apprec iate an update from China with respect to the revision of the measure. Could China also 
confirm if revised draft  will be notified  to the WTO for comments. The EU recalls the importance to 
allow for adequate participation of interested parties  in the domest ic processes.  
 
__________