G/TBT/W/567  
 
29 November 2018  
(18-7536) Page: 1/2 
Committee on Technical Barriers to Trade  Original: English  
 
 
CHINA — REQUIREMENTS  FOR INFORMATION SEC URITY PRODUCTS, INCL UDING, INTER 
ALIA, THE OFFICE OF STATE COMMERCIAL CRY PTOGRAPHY ADMINISTRA TION (OSCCA) 
1999 REGULATION ON C OMMERCIAL ENCRYPTION  PRODUCTS AND ITS ON -GOING 
REVISION AND THE MUL TI-LEVEL PROTECTION SCHEME (MLPS);  
 
CHINA — BANKING IT E QUIPMENT SECURITY RE GULATION;  
 
CHINA — INSURANCE RE GULATORY COMMISSION (CIRC) INFORMATION A ND 
COMMUNICATION TECHNO LOGY REGULATION  
STATEMENT BY THE EUROPEAN UNION  TO THE COMMITTEE ON TECHNICAL BARRIERS T O TRADE  
14 AND 1 5 NOVEMBER  2018 
The following communication, dated 22 November 2018 , is being circulated at the request of the 
delegation of the European Union . 
_______________  
1.  The European Union would like to reiterate  the importance of clarifying the implications and 
consequences of the adoption and entry into for ce of China's new Cybersecurity Law for the existing 
rules, notably the Multi Level Protection Scheme  ('MLPS ') . 
2.  The EU has recently submitted comments on the draft "Guidelines for grading of classified 
cybersecurity protection ", recalling that under the established MLPS , a grading into protection level 
three or above has led to the de facto exclusion of foreign -invested vendors . Together with the wide 
scope of application of protection level three and ab ove under the established MLPS , this has led to 
unwarranted and significant market entry restriction.  The EU's main concerns with regard to the 
Guidelines are therefore i) the further extension in scope of protection level three and above, ii) the 
nature o f the expert review that the Guidelines prescribe, as well as (iii) a lack of clarify in certain  
definitions.  
3.  The EU notes that the State Cryptography Administration (SCA) is being tasked with determining 
cryptography -related requirements in relation to t he different protection levels and will further 
develop related standards and specifications. The EU would welcome if relevant information was 
made accessible to all industry stakeholders, including EU -invested enterprises registered in China, 
and notes th at foreign -invested enterprises and associations should be able to participate in the 
formulation of said standards and specifications on an equal basis.  
4.  The EU would like to stress the need for a transparent and predictable process for developing 
rules in  the field of information security. The EU welcomes existing  public consultations on certain 
draft rules but this is not yet systematic. We would like to request that  stakeholders be informed in 
advance about the entering into force of these measures.  
5.  In this context, the EU notes with concern that the relevant Working Group 3 on cryptography 
within the TC260 standards development organisation remains  closed to foreign industry . Similarly,  
the related industry -level standardisation body  under the SCA, the Cryptography Standardisation 
Technical Committee (CSTC) , has only very limited foreign industry participation.  
6.  The EU notes that it is stipulated that  "cryptography application security tests and evaluations" 
should be  mandatorily conducted before any depl oyment for networks of protection level three  and G/TBT/W/567  
 
- 2 - 
 
  above . We would welcome if reference s to "administrative measures" and "relevant standards" could 
be made more specific and recall in this context the provisions of the TBT Agreement.  
7.  The EU also seeks clarification on whether  the new Cyber -MLPS replaces the old one . Some of 
the standards developed to implement it suggest this, but there has been  no official announcement 
on this .  
8.  As for the rules applicable to the insurance sector, the EU reiterates its  concerns regarding the 
draft insurance sector informatization rules . It would ha ve the effect of mandating insurance 
institutions in China to progressively phase out non -domestic cryptographic products. This would be 
tantamount to a ban on procuring forei gn cryptography products compared with domestic products 
and would prevent insurance institutions from using the most developed and innovative encryption 
products and solutions which would have the unintended consequence of weakening , rather than 
strengthe ning, information and network security.  
9.  The EU would like to recall that the concept of "secure and controllable", which is then also used 
in the National Security Law and the Cybesecurity Law, lacks precision and creates uncertainty for 
economic operator s.  
10.  In addition, the EU has previously raised its concerns regarding the requirement that insurance 
institutions obtain the ownership of the source code of the equipment and the compulsary use of 
national standards and encryption requirements based on nati onal algorithms.  The EU would 
therefore appreciate an update from China with respect to the revision of the measure.  
11.  Finally, we kindly ask that  China confirm s whether the  revised draft will be notified to the WTO 
for comments. The EU recalls the importan ce of allowing for adequate participation of interested 
parties in domestic processes.  
__________