G/TBT/W/554  
 
9 July 2018  
(18-4297) Page: 1/2 
Committee on Technical Barriers to Trade   Original: English  
 
CHINA — REQUIREMENTS FOR INF ORMATION SECURITY PR ODUCTS, INCLUDING, I NTER 
ALIA, THE OFFICE OF STATE COMMERCIAL CRY PTOGRAPHY ADMINISTRA TION (OSCCA) 
1999 REGULATION ON C OMMERCIAL ENCRYPTION  PRODUCTS AND ITS ON -GOING 
REVISION AND THE MUL TI-LEVEL PROTECTION SCH EME (MLPS);  
 
CHINA — BANKING IT EQUIPMENT  SECURITY REGULATION;   
 
CHINA — INSURANCE REGULATORY  COMMISSION (CIRC) IN FORMATION AND 
COMMUNICATION TECHNO LOGY REGULATION G/TBT/ N/CHN/1172  
STATEMENT BY THE EUR OPEAN UNION TO THE C OMMITTEE ON TECHNICA L BARRIERS TO TRADE  
20 AND 21  JUNE 2018 
The following communication, dated 9 July 2018, is being circulated at the request of the 
delegation of the European Union . 
 
_______________  
 
 
1.  The European Union reiterates the importance of clarifying the implications and conseq uences 
of the adoption and entry into forse of the new Cybersecurity Law for the existing rules, notably 
the MLPS and the OSCCA regulation on commercial encryption products.  
2.  The OSCCA regulation had been under review for many years and the European Union w ould 
appreciate an update concerning both the timing of the review of the OSCCA regulation and the 
process for the overall review of the MLPS along with the OSCCA regulation to bring them in line 
with the new Cybersecurity Law.  
3.  The EU has recently submitt ed comments on the draft "Guidelines for grading of classified 
cybersecurity protection, recalling that under the established Multi Level Protection Scheme 
('MLPS') a grading into protection level three or above has led to the de facto exclusion of foreign -
invested vendors; together with the wide scope of application of protection level three and above 
under the established MLPS this has led to unwarranted and significant market entry restriction.  
The EU's main concerns with regard to the Guidelines are the refore i) the further extension in 
scope of protection level three and above, ii) the nature of the expert review that the Guidelines 
prescribe, as well as (iii) a lack of clarify in some definitions.  
4.  The EU would like to stress the need for a transparent  and predictable process for developing 
rules in the field of information security. The EU welcomes the public consultations on certain draft 
rules but this is not yet systematic. We would furthermore welcome keeping the stakeholders 
informed in advance ab out the entering into force of these measures.  
5.  Moreover, the EU would like to recall the importance of openness and accessibility of the 
standardization process in this field, considering that any third party assessment of products for 
the purpose of info rmation security would be carried out according to mandatory standards.  
6.  Despite China's assurances that access to standardisation bodies is open to foreign companies, 
the EU notes that the key technical committee for information security (TC 260) still re fuses access 
to some foreign invested enterprises in China.  The EU kindly requests China to notify draft 
measures in any subsequent sectoral implementation to the TBT Committee in order to give G/TBT/W/554  
 
- 2 - 
 
  adequate opportunity for WTO Members and their stakeholders to  comment on any subsequent 
developments.  
7.  As for the rules applicable to the insurance sector, the EU reiterates its concerns regarding the 
draft insurance sector informatization rules, which have the effect of mandating insurance 
institutions in China to p rogressively phase out non -domestic cryptographic products. This would 
be tantamount to a ban on procuring foreign cryptography products compared with domestic 
products and would prevent insurance institutions from using the most developed and innovative 
encryption products and solutions which would have the unintended consequence of weakening 
rather than strengthening information and network security.  
8.  The EU would like to recall that the concept of "secure and controllable", which is then also 
used in the  National Security Law and the Cybesecurity Law, lacks precision and creates 
uncertainty for economic operator.  
9.  In addition, the EU raised its concerns regarding the requirement that insurance institutions 
obtain the ownership of the source code of the eq uipment and the compulsary use of national 
standards and encryption requirements based on national algorithms.  The EU would therefore 
appreciate an update from China with respect to the revision of the measure. Could China also 
confirm if revised draft will be notified to the WTO for comments. The EU recalls the importance to 
allow for adequate participation of int erested parties in the domestic processes.  
 
 
__________