G/TBT/W/632  
 
8 April  2019 
(19-2250) Page: 1/2 
Committee on Technical Barriers to Trade  Original: English  
 
CHINA - DRAFT REVISE D ENCRYPTION LAW OF THE PEOPLE'S REPUBLI C OF CHINA BY 
THE OFFICE OF STATE COMMERCIAL CRYPTOGRA PHY ADMINISTRATION ( OSCCA)  
STATEMENT BY THE EUROPEAN UNION TO THE COMMITTEE ON TECHNICAL BARRIERS T O TRADE  
6 AND 7  MARCH  2019 
The following communication, dated 5 April  2019, is being circulated at the request of the delegation 
of the European Union . 
_______________  
1.  The EU would like to reiterate  its concern on the draft Cryptography Law published by the Office 
of State Commercia l Cryptography Administration (OSCCA). The EU recalls the  written comments  it 
has submitted  to the public consul tation and repeated several times in this Committee, and would 
like to once again highlight certain concerns.   
2.  The EU is concerned about the ris k-based approach taken in the draft law. We understand this is 
aimed at reducing the number of e -crime incidents, but it also will affect the daily operations of EU 
companies.  
3.  The EU is concerned w hen it comes to use of encryption products because the draft law is also 
very broad in scope and appears to aim at regulating all uses of cryptography. Its scope of application 
for ICT products and services far exceeds those primarily dedicated to encryption . 
4.   The EU reiterates its concern on the draft law's approach  which is  based on administrative 
license -focused cryptography regime, in other words on "regulation " for commercial cryptography, 
as per the following:  
a. It imposes a licensing scheme on the sale, use, import and export of commercial 
cryptography.  
b. It seems to depart from international practice, as well as previous commitments by China, 
including the March 2000 Clarification by OSCCA. According to these commitments ICT 
products would not be subject to licensing requirements and similar regulatory cons traints, 
unless the core function of the products is encryption. However, the draft law potentially 
captures a much wider range of products subjecting them to restrictions . The EU's industry 
active in cryptography and semiconductors notes a risk of a regre ssion. The new draft 
Cryptography Law has no longer any such restriction. In fact it appears to be very broad 
in scope and used concepts such as "common ", "commercial " or "core" encryption that 
should be further defined . 
c. It foresees a pre -market approval o bligation for commercial cryptographic products. This 
requirement is cumbersome and is a departure from international practice. More generally, 
we wonder whether the Law 's underlying approach , which is relying on ex ante pre -market 
approvals , can do justic e to a dynamic and continuously innovating industry.  The EU would 
welcome more precise information about the government body entrusted with this 
function, and on what is the detailed procedure for import licence and the detailed security 
concerns of equipm ent. G/TBT/W/632  
 
- 2 - 
 
  d. It mandates "classified and graded assessments for the security of cryptographic 
applications in Critical Information Infrastructure (CII) " 
e. The EU is also concerned that the se regulatory requirements related to market access are 
discriminatory, are no t technolog y neutral , and lead to the forced transfer of intellectual 
property (e.g. by requiring mandatory disclosure of encryption keys).   
5.  In addition, the EU would welcome the explanation about the selection of sectors China has 
identified as Critical I nformation Infrastructure, many of which have actually no impact on national 
security or even public order.  
6.  Finally, the EU is of the opinion that the draft does not recognise the key role of international 
standards in ensuring global interoperability in t he area of cryptography.  
7.  The EU kindly requests China to take these comments into account and modify the draft law 
accordingly.  
__________