G/TBT/W/593  
 
20 December 2018  
(18-8072) Page: 1/2 
Committee on Technical Barriers to Trade  Original: English  
 
CYBERSPACE ADMINISTR ATION OF CHINA – DRAFT IMPLEMENTING MEAS URES  
FOR THE CYBERSECURIT Y REVIEW OF NETWORK PRODUCTS AND SERVICE S  
STATEMENT BY THE EUR OPEAN UNION TO THE COMMITTEE ON TECHNICAL BARRIERS T O TRADE  
14 AND 15  NOVEMBER  2018 
The f ollowing communication, dated 20 December 2018, is being circulated at the request of the 
delegation of the European Union . 
_______________  
1.  The EU would like to reiterate its concern on the draft Cryptography Law published by the Office 
of State Commercial Cryptogr aphy Administration (OSCCA). The EU has already provided written 
comments to the public consultation.  As conveyed in those comments, the EU is significantly 
concerned about some aspects of the draft law. Despite the fact that China's government has long 
ago assured the Commercial Encryption Regulations of 1999 would be revised, this has not yet been 
the case. Instead, and quite unexpectedly, a draft for the Cryptography Law was released, which 
would provide a first -order legal basis for the entire domain.  
2.  The EU is concerned when it comes to use of encryption products because the draft law is also 
very broad in scope and appears to aim at regulating all uses of cryptography. Its scope of application 
for ICT products and services far exceeds those primarily dedicated to encryption, thus imposing 
what are in our view unnecessary restrictions on many products and services. In this context, the 
EU would like to ask China to clarify the intended scope of the draft, especially by precisely defining 
key concepts, s uch as "common", "core" and "commercial" cryptography.  
3.  The EU reiterates its concern about t he 2017 draft Cryptography Law and the fact that it adopts 
an approach based on administrative license -focused cryptography regime, in other words on 
"regulation " for commercial cryptography, as per the following:  
a. It imposes a licensing scheme on the sale, use, import and export of commercial 
cryptography.  
b. It seems to depart from international practice, as well as previous commitments by China, 
including the March 2 000 Clarification by OSCCA. According to these commitments ICT 
products would not be subject to licensing requirements and similar regulatory constraints, 
unless the core function of the products is encryption. However, the draft law potentially 
captures a  much wider range of products subjecting them to restrictions.  
c. It foresees a pre -market approval obligation for commercial cryptographic products. This 
requirement is cumbersome and is a departure from international practice.  
d. It mandates "classified and graded assessments for the security of cryptographic 
applications in Critical Information Infrastructure (CII) " 
e. The EU is also concerned that the above regulatory requirements related to market access 
are discriminatory, are not technology neutral, and lea d to the forced transfer of 
intellectual property (e.g. by requiring mandatory disclosure of encryption keys).  G/TBT/W/593  
 
- 2 - 
 
  4.  In addition, the EU would welcome the explanation about the selection of sectors China has 
identified as Critical Information Infrastructure, ma ny of which have actually no impact on national 
security.  Finally, the EU is of the opinion that the draft does not recognise the key role of international 
standards in ensuring global interoperability in the area of cryptography. The EU kindly requests 
China to take these comments into account and modify the draft law accordingly.  
__________