   
  
G/TBT/W/682  
 
25 November 2019  
(19-8005) Page: 1/2 
Committee on Technical Barriers to Trade  Original: English  
 
 
CHINA – REQUIREMENTS  FOR INFORMATION SEC URITY PRODUCTS, INCL UDING, INTER 
ALIA , THE OFFICE OF STAT E COMMERCIAL CRYPTOG RAPHY ADMINISTRATION  (OSCCA) 
1999 REGULATION ON C OMMERCIAL ENCRYPTION  PRODUCTS AND ITS ON -GOING 
REVISION AND THE MUL TI-LEVEL PROTECTION SCHEME (MLPS)  
STATEMENT BY  THE EUROPEAN UNION TO THE COMMITTEE ON TECHNICAL BAR RIERS TO TRADE  
13 – 15 NOVEMBER  2019 
The following communication, dated 13 November  2019, is being circulated at the request of the 
delegation of the European Union . 
 
_______________  
 
 
1.  The European Union would like to reiterate the importance of clarifying  the implications of the 
adoption and entry into force of China's new Cybersecurity Law for the existing rules, notably the 
Multi-Level Protection Scheme.  
2.  The EU would like to recall the comments it has submitted on the draft "Guidelines for grading 
of cla ssified cybersecurity protection", and repeated several times in this Committee, including on 
de facto exclusion of foreign -invested vendors as a result of protection level 3 and above under the 
established MLPS. Together with the wide scope of application  of protection level 3 and above under 
the established MLPS, this has led to unwarranted and significant market entry restrictions. The EU's 
main concerns with regard to the Guidelines are (i) the further extension in scope of protection level 
three and ab ove, (ii) the nature of the expert review that the Guidelines prescribe, and (iii) a lack 
of clarify in certain definitions.  
3.  The EU calls for enhanced proportionality and transparency in the implementation of the Cyber 
Multi-Level Protection Scheme, inste ad of introducing overly burdensome requirements and 
broadening the scope of Level 3 networks. The EU has noticed that due to the ambiguity of 
self-assessment rules for all levels, especially assessments at levels 3 and above, this translates in 
a de facto  closure of markets for EU companies.  
4.  The lack of access to relevant Chinese Standards Developing Organisations becomes particularly 
pressing with regard to the Cyber -MLPS, which will draw heavily on a number of mandatory and 
recommended standards to be d eveloped by these standardisation bodies. The EU notes the recent 
positive developments in accessing Working Group 3 on encryption of the TC260 standards 
development organisation. However, no semiconductor companies have been admitted as yet. We 
continue t o monitor the developments closely. The related industry -level standardisation body, the 
Cryptography Standardisation Technical Committee (CSTC) has only one single foreign industry 
participant. The EU therefore calls once again for the State Cryptography Administration to make 
information accessible to all industry stakeholders, including EU -invested enterprises registered in 
China, which should also be able to participate in the formulation of said standards and specifications 
on an equal basis. We would also like to request that stakeholders be informed in advance about the 
entering into force of these measures.  
5.  The EU also seeks clarification on whether the new Cyber -MLPS replaces the old one. Some of 
the standards developed to implement it suggest this , but there has been no official announcement 
in this regard. More generally, the key provisions and concepts leave considerable room for 
interpretation. The Regulation also refers, in several articles, to a number of standards, some of 
which are still to be developed, without however giving any further specifications. Also, various G/TBT/W/682  
 
- 2 - 
 
  different governmental authorities are being referred to throughout the Regulation with at times, no 
clear guidance as to which authority specifically is deemed competent to rul e on the matter at hand. 
Taken together, the EU believes these points unnecessarily introduce complexity, costs and 
compliance risks. The EU encourages cross -ministerial coordination on cybersecurity legislation and 
standardisation.  
6.  Finally, we ask that Ch ina confirms whether the revised draft will be notified to the WTO for 
comments. The EU recalls the importance of allowing for adequate participation of interested parties 
in domestic processes.  
 
__________  