China’s Cryptography Law: Embarking on a New Era of Cryptography Regulation [Brought to you by JunHe] – Legal Business Online

Fang Zhou and Yue (Brett) Zhang of JunHe review the old regulatory system of cryptography law and how the newly introduced PRC Cryptography Law brings a more flexible approach for cipher products to flourish in China

On Oct. 26, 2019, the Standing Committee of the National Peoples Congress passed the PRC Cryptography Law (Cryptography Law) (). The Cryptography Law is the first cryptography statute at a national law level, replacing old regulations that have been in use for more than two decades. By introducing major changes to the existing regulatory regime on cipher products, the Cryptography Law marks a new era of cipher regulation in China, particularly in relation to the use of cipher in commercial environment.

The Cryptography Law introduces classification of ciphers based on the nature of the data or information they intend to protect:

The Cryptography Law does not stipulate general approval procedure for R&D, manufacture, sale, use and import of plain commercial cipher products. Instead, the Cryptography Law plans to regulate commercial cipher products by way of formulating and implementing relevant national standards, which presumably should be technical in nature and may also incorporate overseas or internationally recognized standards with necessary localization. As exceptions, the Cryptography Law permits the PRC government to establish import/export approval for commercial cipher products that concern Chinas national security, public interests and welfare, or international commitments made by the PRC government.

The Cryptography Law makes it clear that a non-discriminatory principle should be observed in relation to foreign invested companies and their activities involving commercial cipher. It further requires that no PRC authority may force any foreign invested companies to disclose or transfer their commercial cipher by administrative measures.

Despite the general non-approval approach, the Cryptography Law provides certain exceptional cases where commercial cipher products may be subject to additional certification or assessment requirements:

LOOKING FORWARD

However, it remains to be seen how the PRC authority will define exceptional cases through future implementation of the Cryptography Law, particularly with respect to the scope of key terms such as national security or public welfare. Giving these exceptional cases a broad scope means more commercial cipher products would need to obtain certification or pass review or assessment procedures supervised by the authorities. This may, to some extent, undermine the benefit of the non-approval principle set out by the Cryptography Law because such procedures may be structured as a modified form of governmental approval.

More here:
China's Cryptography Law: Embarking on a New Era of Cryptography Regulation [Brought to you by JunHe] - Legal Business Online