NPCSC Passes Cryptography Law, Grants State Supervision Commission Rulemaking Power & Approves New Free Trade Zone Pilots

UPDATE (Nov. 2, 2019): An unofficial English translation of the Cryptography Law is now available on China Law Translate.

The 13th NPC Standing Committee (NPCSC) concluded its fourteenth session on Saturday, October 26. It adopted a new Cryptography Law [密码法] and three decisions concerning reforms in China’s free trade zones, the State Supervision Commission’s power, and the integration of the Greater Bay Area. Below we will provide a brief summary of each.

Cryptography Law

The Cryptography Law marks a new step both in strengthening China’s national security regime and in furthering the government’s ongoing efforts to cut red tape. The Law defines “cryptography” [密码] as “technologies, products, and services that use specific transformations to carry out encryption protection or security authentication for information, etc.” (art. 2). It distinguishes between “core,” “ordinary,” and “commercial” cryptography and subjects the three categories to differential regulation (art. 6). Core and ordinary cryptography is deemed state secrets and will be used to protect state secret information (art. 7), whereas commercial cryptography will be used to protect other information (art. 8).

The Law is said to significantly liberalize the regulation of commercial cryptography. For instance, current Regulations on the Administration of Commercial Cryptography [商用密码管理条例] prohibit entities and individuals from selling or using foreign cryptography products (see arts. 13–14). The Law imposes no such prohibition. To the contrary, it explicitly provides for the equal treatment of commercial cryptography developed both overseas and domestically and forbids the forced transfer of commercial cryptography technology in connection with foreign investments (art. 21, para. 2).

The Law does more strictly regulate commercial cryptography that may implicate national security and other important government interest. For instance, it requires an import license for commercial cryptography that implicates “national security or the public interest” and that “provides an encryption-protection function” (art. 28, para. 1). It also imposes export control on commercial cryptography that implicates national security, the public interest, or China’s international obligations (id.). Commercial cryptography used in “products for popular consumption” [大众消费类产品] is exempted from the import-licensing and export-control schemes, however (id. para. 2). Further, the Law requires that commercial cryptography that is classified as Critical Network Equipment [网络关键设备] or Specialized Network Security Product [网络安全专用产品目录] be tested and certified in accordance with the Cybersecurity Law [网络安全法] (art. 26, para. 1); and that operators of Critical Information Infrastructure [关键信息基础设施] submit to national security review under the same statute if their purchase of commercial-cryptography products or services may affect national security (art. 27, para. 2). Violations of these requirements carry hefty fines and other penalties (see Ch. IV).

One more observation about this Law’s final text. An earlier draft released by the State Council in 2017 would require that telecommunications companies and internet service providers provide “decryption technical support” to the police, state security authorities, and the procuratorates for national security reasons or to aid in the prosecutions of crimes (see art. 20). The final text of the Law dropped this requirement.

The Cryptography Law will take effect on January 1, 2020.

Decisions

First, the NPCSC adopted a decision granting the State Supervision Commission authority to promulgate “supervisory regulations” [监察法规]. Such a decision is necessary, according to the Commission, because it intends to issue a set of implementing regulations of the Supervision Law [监察法] (its governing statute), but the statute does not expressly vests it with rulemaking power. The NPCSC’s decision thus authorizes the Commission to formulate supervisory regulations in accordance with the Constitution and statutes (1) to “implement the provisions of laws” or (2) to “perform its duty to lead the supervision commissions at all levels” (art. 1, para. 2). Supervisory regulations must be approved by the full Commission (art. 2) and must be recorded with the NPCSC within 30 days of their promulgation (art. 3, para. 1). The NPCSC has the authority to revoke supervisory regulations that conflict with the Constitution or statutes (id. para. 2). The decision’s explanation indicates that the decision would be codified by a future amendment to the Legislation Law [立法法]. The decision has taken effect on Sunday.

Second, per the State Council’s request, the NPCSC authorized a three-year pilot program in all of China’s 18 free trade zones to reduce administrative licenses and ease the compliance burden on businesses. Specifically, seven licensing provisions in the Foreign Trade Law [对外贸易法], Road Traffic Safety Law [道路交通安全法], Fire Control Law [消防法], Food Safety Law [食品安全法], Customs Law [海关法], and Seeds Law [种子法] will be suspended during the pilot period. Of note, the decision suspended a provision in the Fire Control Law requiring a governmental fire-safety inspection before a public-gathering venue is put in use. Instead, as part of the pilot, the constructor or operator of the venue will only need to promise to the authorities (with supporting materials) that the venue complies with fire-safety rules; the government would no longer conduct an on-site inspection. A few legislators expressed unease with this change during the deliberations, but the State Council’s proposal is included in the final version without change. The NPCSC’s authorization will take effect on December 1, 2019.

Finally, the NPCSC authorized Macau to exercise jurisdiction over the Macau Port Area of the renovated Hengqin Port and the relevant extension area—which are located on the mainland-Macau border but geographically in the mainland. Previously, traffic between the mainland and Macau had to pass through two separate immigration checkpoints connected by the Lótus Bridge: the (old) Hengqin Port in the mainland and the Cotai Frontier Post in Macau. This arrangement is said to be “time-consuming and inconvenient,” especially as the cross-border traffic continues to rise. Thus, the Macau government has proposed, and the State Council has agreed, to merge the two checkpoints as part of the mainland Hengqin Port renovation. Under the NPCSC’s decision, Macau’s jurisdiction would extend not only to the Macau Port Area of the renovated Hengqin Port, but also to (among others) the Lótus Bridge (except its pillars) and the areas reserved for the Macau Light Rapid Transit’s extension to the Hengqin Port. Macau would secure the right to use the aforesaid areas under a lease from the local mainland government, which will expire on the eve of the 50th anniversary of Macau’s handover to China (December 19, 2049), unless extended by the NPCSC.

We expect the NPCSC to solicit public comments on the following bills this week:

If you like this Blog, please consider subscribing to our blog posts, following us on Twitter, or liking us on Facebook—and making a donation!

PDF 📄