The 11th Session of the Standing Committee of the 13th National People's Congress, PRC Cryptography Law (Draft)

Issued: July 5, 2019

Main contents: No organization or individual may steal the encrypted information of a third party, unlawfully access a third party's cryptographic system, or use cryptography to engage in activities that jeopardize national security, the public interest or the lawful rights and interests of third parties, or other illegal or criminal activities (Article 12).

Where a law, or set of administrative regulations or relevant state provisions requires the use of commercial cryptography to protect critical information infrastructure, the operator thereof shall use commercial cryptography to protect the same and conduct an assessment of the security of the commercial cryptography applications.

Where the network products and services procured and used by the operator of critical information infrastructure or a state authority involves commercial cryptography and could affect national security, the same shall be subject to a national security review organized by the state cyberspace administration in concert with relevant authorities such as the state cryptography administration (Article 27).

The State Council department in charge of commerce and state cryptography administration shall, in accordance with the law, subject commercial cryptographic products that have a bearing on national security or the public interest and that have encryption functions to import licensing, and commercial cryptographic products that have a bearing on national security, the public interest or international obligations borne by China to export control. The list of commercial cryptographic products subject to import licensing and export control shall be formulated and published by the State Council department in charge of commerce in concert with the state cryptography administration and the General Administration of Customs.

Commercial cryptography used in mass consumption products shall not be subject to the import licensing and export control systems (Article 28).