美国出口管制制度系列文章之一：对“外国生产的产品”的相关规则
编者按：
“个人数据与域外国家安全审查初探”系列文章的核心要旨：一是跟踪、分析域外国家安全相关的法律制度对数据安全，特别是个人数据，流变的立场；二是服务我国企业走出去；三是给国内相关监管制度设计提供借鉴。此前该系列中已经发表的公号文章：
另外一个系列“美国电信行业涉及外国参与的安全审查”，分析的是美国对我国在电信行业的“清算”：
本公号也曾就中国的网络安全审查撰写过系列宣介文章：
本系列文章将就美国的出口管制制度开展研究。第一篇文章关注美国新近修改的与“外国生产的产品”相关的规则”（the foreign produced items）。
美国商务部5月15日在公告（全文翻译后附）中对其《出口管理条例》做出修订。在修订说明中，美商务部给出了如下背景介绍：
接下来，公号君将根据商务部的这段话按图索骥，把主要法条罗列出来。
第一：“受《出口管理条例》管辖”
§ 734.2 Subject to the EAR.
(a) Subject to the EAR - Definition.
(1) “Subject to the EAR” is a term used in the EAR to describe those items and activities over which BIS exercises regulatory jurisdiction under the EAR. Conversely, items and activities that are not subject to the EAR are outside the regulatory jurisdiction of the EAR and are not affected by these regulations. The items and activities subject to the EAR are described in §§ 734.2 through 734.5 of this part. You should review the Commerce Control List (CCL) and any applicable parts of the EAR to determine whether an item or activity is subject to the EAR. However, if you need help in determining whether an item or activity is subject to the EAR, see § 734.6 of this part. Publicly available technology and software not subject to the EAR are described in §§ 734.7 through 734.11 and supplement no. 1 to this part.
(2) Items and activities subject to the EAR may also be controlled under export-related programs administered by other agencies. Items and activities subject to the EAR are not necessarily exempted from the control programs of other agencies. Although BIS and other agencies that maintain controls for national security and foreign policy reasons try to minimize overlapping jurisdiction, you should be aware that in some instances you may have to comply with more than one regulatory program.
(3) The term
“subject to the EAR” should not be confused with licensing or other
requirements imposed in other parts of the EAR. Just because an item or
activity is subject to the EAR does not mean that a license or other
requirement automatically applies. A license or other requirement
applies only in those cases where other parts of the EAR impose a
licensing or other requirement on such items or activities.
第二：“最低含量规则” (De minimis rule)
§ 734.4 De minimis U.S. content.
(a) Items for which there is no de minimis level.
(1) There is no de minimis level for the export from a foreign country of a foreign-made computer with an Adjusted Peak Performance (APP) exceeding that listed in ECCN 4A003.b and containing U.S.-origin controlled semiconductors (other than memory circuits) classified under ECCN 3A001 to Computer Tier 3 destinations; or exceeding an APP listed in ECCN 4A994.b and containing U.S.-origin controlled semiconductors (other than memory circuits) classified under ECCN 3A001 or high speed interconnect devices (ECCN 4A994.j) to Cuba, Iran, North Korea, Sudan, and Syria.
(2) Foreign produced encryption technology that incorporates U.S. origin encryption technology controlled by ECCN 5E002 is subject to the EAR regardless of the amount of U.S. origin content.
(3) [Reserved]
(4) There is no de minimis level for U.S.-origin technology controlled by ECCN 9E003.a.1 through a.8,.h, .i., and .j., when redrawn, used, consulted, or otherwise commingled abroad.
(5) There is no de minimis level for foreign-made “military commodities” incorporating one or more of the commodities described in ECCN 0A919.a.1 when destined for a country listed in Country Group D:5 of supplement no. 1 to part 740 of the EAR.
(6) 9x515 and “600 series.”
(i) There is no de minimis level for foreign-made items that incorporate U.S.-origin 9x515 or “600 series” items enumerated or otherwise described in paragraphs .a through .x of a 9x515 or “600 series” ECCN when destined for a country listed in Country Group D:5 of supplement no. 1 to part 740 of the EAR.(ii) There is no de minimis level for foreign-made items that incorporate U.S.-origin 9x515 or “600 series” .y items when destined for a country listed in Country Group E:1 or E:2 of supplement no. 1 to part 740 of the EAR or for the People's Republic of China (PRC).(7) Under
certain rules issued by the Office of Foreign Assets Control, certain
exports from abroad by U.S.-owned or controlled entities may be
prohibited notwithstanding the de minimis provisions of the EAR. In addition, the de minimis
rules do not relieve U.S. persons of the obligation to refrain from
supporting the proliferation of weapons of mass-destruction and missiles
as provided in § 744.6 of the EAR.
(b) Special requirements for certain encryption items.
Non-U.S.-made items that incorporate U.S.-origin items that are listed
in this paragraph are subject to the EAR unless they meet the de minimis level and destination requirements of paragraph (c) or (d) of this section and the requirements of this paragraph.
(1) The U.S.-origin commodities or software, if controlled under ECCN 5A002, ECCN 5B002, equivalent or related software therefor classified under ECCN 5D002, and “cryptanalytic items” classified under ECCN 5A004 or 5D002, must have been:
(i) Publicly available encryption source code classified under ECCN 5D002 that has met the notification requirement of § 742.15(b), see § 734.3(b)(3) of the EAR. Such source code does not have to be counted as controlled U.S.-origin content in a de minimis calculation;(ii) Authorized for License Exception ENC by BIS after classification pursuant to § 740.17(b)(3) of the EAR;(iii) Authorized for License Exception ENC by BIS after classification pursuant to § 740.17(b)(2) of the EAR, and the non-U.S.-made product will not be sent to any destination in Country Groups E:1 and E:2 in Supplement No. 1 to part 740 of the EAR; or(iv) Authorized for License Exception ENC pursuant to § 740.17(b)(1) of the EAR.(2) U.S.-origin encryption items classified under ECCNs 5A992.c, 5D992.c, or 5E992.b.
Note to paragraph (b):
See Supplement No. 2 to this part for de minimis calculation procedures and reporting requirements.
(c) 10% De Minimis Rule. Except as provided in paragraphs (a) and (b)(1)(iii) of this section and subject to the provisions of paragraphs (b)(1)(i), (b)(1)(ii) and (b)(2) of this section, the following reexports are not subject to the EAR when made to any country in the world. See supplement no. 2 of this part for guidance on calculating values.
(1) Reexports of a foreign-made commodity incorporating controlled U.S.-origin commodities or “bundled” with U.S.-origin software valued at 10% or less of the total value of the foreign-made commodity;
Notes to paragraph (c)(1):
(1) U.S.-origin software is not eligible for the de minimis exclusion and is subject to the EAR when exported or reexported separately from (i.e., not bundled or incorporated with) the foreign-made item.
(2) For the purposes of this section, ‘bundled’ means software that is reexported together with the item and is configured for the item, but is not necessarily physically integrated into the item.
(3) The de minimis
exclusion under paragraph (c)(1) only applies to software that is
listed on the Commerce Control List (CCL) and has a reason for control
of anti-terrorism (AT) only or software that is designated as EAR99
(subject to the EAR, but not listed on the CCL). For all other software,
an independent assessment of whether the software by itself is subject
to the EAR must be performed.
(2)
Reexports of foreign-made software incorporating controlled U.S.-origin
software valued at 10% or less of the total value of the foreign-made
software; or
(3)
Reexports of foreign technology commingled with or drawn from
controlled U.S.-origin technology valued at 10% or less of the total
value of the foreign technology. Before you may rely upon the de minimis
exclusion for foreign-made technology commingled with controlled
U.S.-origin technology, you must file a one-time report. See supplement
no. 2 to part 734 for submission requirements.
(d) 25% De Minimis Rule. Except as provided in paragraph (a) of this section and subject to the provisions of paragraph (b)
of this section, the following reexports are not subject to the EAR
when made to countries other than those listed in Country Group E:1 or
E:2 of supplement no. 1 to part 740 of the EAR. See supplement no. 2 to
this part for guidance on calculating values.
(1) Reexports of a foreign-made commodity incorporating controlled
U.S.-origin commodities or “bundled” with U.S.-origin software valued at
25% or less of the total value of the foreign-made commodity;
Notes to paragraph (d)(1):
(1) U.S.-origin software is not eligible for the de minimis exclusion and is subject to the EAR when exported or reexported separately from (i.e., not bundled or incorporated with) the foreign-made item.
(2) For the purposes of this section, “bundled” means software that is reexported together with the item and is configured for the item, but is not necessarily physically integrated into the item.
(3) The de minimis
exclusion under paragraph (d)(1) only applies to software that is
listed on the Commerce Control List (CCL) and has a reason for control
of anti-terrorism (AT) only or software that is classified as EAR99
(subject to the EAR, but not listed on the CCL). For all other software,
an independent assessment of whether the software by itself is subject
to the EAR must be performed.
(2)
Reexports of foreign-made software incorporating controlled U.S.-origin
software valued at 25% or less of the total value of the foreign-made
software; or
(3)
Reexports of foreign technology commingled with or drawn from
controlled U.S.-origin technology valued at 25% or less of the total
value of the foreign technology. Before you may rely upon the de minimis
exclusion for foreign-made technology commingled with controlled
U.S.-origin technology, you must file a one-time report. See supplement
no. 2 to part 734 for submission requirements.
(e) You are responsible for making the necessary calculations to determine whether the de minimis
provisions apply to your situation. See supplement no. 2 to part 734
for guidance regarding calculation of U.S. controlled content.
(f) See § 770.3 of the EAR for principles that apply to commingled U.S.-origin technology and software.
(g) Recordkeeping requirement. The method by which you determined the percentage of U.S. content in foreign software or technology must be documented and retained in your records in accordance with the recordkeeping requirements in part 762 of the EAR. Your records should indicate whether the values you used in your calculations are actual arms-length market prices or prices derived from comparable transactions or costs of production, overhead, and profit.
第三：一般性禁止和适用性考量（General prohibitions and determination of applicability）
§ 736.2 General prohibitions and determination of applicability.
(a) Information or facts that determine the applicability of the general prohibitions. The following five types of facts determine your obligations under the ten general prohibitions and the EAR generally:
(1) Classification of the item. The classification of the item on the Commerce Control List (see part 774 of the EAR);
(2) Destination. The country of ultimate destination for an export or reexport (see parts 738 and 774 of the EAR concerning the Country Chart and the Commerce Control List);
(3) End-user. The ultimate end user (see General Prohibition Four (paragraph (b)(4) of this section) and supplement no. 1 to part 764 of the EAR for references to persons with whom your transaction may not be permitted; see General Prohibition Five (Paragraph (b)(5) of this section) and part 744 for references to end-users for whom you may need an export or reexport license).
(4) End-use. The ultimate end-use (see General Prohibition Five (paragraph (b)(5) of this section) and part 744 of the EAR for general end-use restrictions); and
(5) Conduct. Conduct
such as contracting, financing, and freight forwarding in support of a
proliferation project as described in part 744 of the EAR.
(b) General prohibitions. The following ten general prohibitions describe certain exports, reexports, and other conduct, subject to the scope of the EAR, in which you may not engage unless you either have a license from the Bureau of Industry and Security (BIS) or qualify under part 740 of the EAR for a License Exception from each applicable general prohibition in this paragraph. The License Exceptions at part 740 of the EAR apply only to General Prohibitions One (Exports and Reexports in the Form Received), Two (Parts and Components Reexports), and Three (Foreign-Produced Direct Product Reexports); however, selected License Exceptions are specifically referenced and authorized in part 746 of the EAR concerning embargo destinations and in § 744.2(c) of the EAR regarding nuclear end-uses.
(1) General Prohibition One - Export and reexport of controlled items to listed countries (Exports and Reexports).
You may not, without a license or License Exception, export any item
subject to the EAR to another country or reexport any item of
U.S.-origin if each of the following is true:
(2) General
Prohibition Two - Reexport and export from abroad of foreign-made items
incorporating more than a de minimis amount of controlled U.S. content
(U.S. Content Reexports).
(i) You
may not, without a license or license exception, reexport or export from
abroad foreign-made commodities that incorporate controlled U.S.-origin
commodities, foreign-made commodities that are “bundled” with
controlled U.S.-origin software, foreign-made software that is
commingled with controlled U.S.-origin software, or foreign-made
technology that is commingled with controlled U.S.-origin technology if
such items require a license according to any of the provisions in the
EAR and incorporate or are commingled with more than a de minimis amount of controlled U.S. content, as defined in § 734.4 of the EAR concerning the scope of the EAR.
(A) It incorporates more than the de minimis amount of controlled U.S. content, as defined in § 734.4 of the EAR concerning the scope of the EAR;
(B) It is controlled for a reason indicated in the applicable ECCN; and
(C) Its export to the country of destination
requires a license for that control reason as indicated on the Country
Chart. (The scope of this prohibition is determined by the correct
classification of your foreign-made item and the ultimate destination, as that combination is reflected on the Country Chart.)
(ii) Each
License Exception described in part 740 of the EAR supersedes General
Prohibition Two if all terms and conditions of a given License Exception
are met by the exporter or reexporter.
(3) General
Prohibition Three - Reexport and export from abroad of the
foreign-produced direct product of U.S. technology and software
(Foreign-Produced Direct Product Reexports) -
(4) General Prohibition Four (Denial Orders) - Engaging in actions prohibited by a denial order.
(5) General Prohibition Five - Export or reexport to prohibited end-uses or end-users (End-Use End-User). You may not, without a license, knowingly export or reexport any item subject to the EAR to an end-user or end-use that is prohibited by part 744 of the EAR.
(6) General Prohibition Six - Export or reexport to embargoed destinations (Embargo).
(7) General Prohibition Seven - Support of proliferation activities (U.S. person proliferation activity) -
(8) General Prohibition Eight - In transit shipments and items to be unladen from vessels or aircraft (Intransit) -
(9) General Prohibition Nine - Violation of any order, terms, and conditions (Orders, Terms, and Conditions).
You may not violate terms or conditions of a license or of a License
Exception issued under or made a part of the EAR, and you may not
violate any order issued under or made a part of the EAR. There are no License Exceptions
to this General Prohibition Nine in part 740 of the EAR. Supplements
Nos. 1 and 2 to this part provide for certain General Orders and
Administrative Orders.
(10) General Prohibition Ten - Proceeding with transactions with knowledge that a violation has occurred or is about to occur (Knowledge Violation to Occur). You may not sell, transfer, export, reexport, finance, order, buy, remove, conceal, store, use, loan, dispose of, transport, forward, or otherwise service, in whole or in part, any item subject to the EAR and exported or to be exported with knowledge that a violation of the Export Administration Regulations, the Export Administration Act or any order, license, License Exception, or other authorization issued thereunder has occurred, is about to occur, or is intended to occur in connection with the item. Nor may you rely upon any license or License Exception after notice to you of the suspension or revocation of that license or exception. There are no License Exceptions to this General Prohibition Ten in part 740 of the EAR.
美国商务部关于修改直接产品规则的公告
美国工业与安全局（BIS）今天宣布，计划通过限制华为使用美国技术和软件在美国境外设计和制造半导体的能力来保护美国国家安全。这一计划将切断华为破坏美国出口管制规则的努力。BIS正在修改其一直以来的关于外国生产的直接产品规则和实体清单，对华为采购由某些美国软件和技术直接制造的半导体，进行精准的战略性打击。
自2019年BIS将华为技术及其114家海外相关关联公司列入实体清单以来，希望向其出口美国物项的公司必须获得许可证。[1]然而，华为继续使用美国的软件和技术来设计半导体，并委托使用了美国设备的海外代工厂来生产这些半导体，这些行为破坏了实体清单所希望达成的国家安全和外交政策的目的。
“尽管美国商务部去年采取了实体清单措施，但华为及其外国关联公司已经加紧努力，意图通过本土化努力来破坏这些基于国家安全的限制。然而，华为的努力仍有赖于美国的技术"，美国商务部部长威尔伯·罗斯说，“这不是一个负责任的全球企业公民的行为方式。我们必须修改被华为和海思所利用的规则，防止美国技术助长违背美国国家安全和外交政策利益的恶性活动。”
具体而言，这一有针对性的规则修改将使以下外国生产的物项受《出口管理条例》（EAR）的限制：
(一) 华为及其实体清单上的关联公司（如海思）使用美国商业管制清单（CCL）中某些软件和技术直接产出的，包括半导体设计在内的物项；以及
(二)根据华为或实体清单上的关联公司（如海思）产出的设计规格，且使用美国商业管制清单（CCL）中列明的某些半导体制造设备直接产出的包括芯片组在内的物项。这些外国生产的产品，只有当出口人知道这些产品将用于再出口，从国外出口，或（在出口人所在国境内）转让给华为或其实体名单上的任何关联公司时，才需要许可证。
为防止对使用美国半导体制造设备的外国代工企业造成直接的不利经济影响，对于在2020年5月15日前根据华为所生产的设计规格已经启动制造流程所产出的物项，只要这些外国生产的物项在本命令生效之日起120天内再出口、从国外出口，或（在出口人所在国境内）转让给华为或其实体名单上的任何关联公司，则不受上述新的许可要求的限制。
[1] 2019年5月，BIS将华为技术有限公司（Huawei Technologies Co. (华为)和某些非美国关联公司被列入实体名单(2019年8月又增列了更多的关联公司)，依据的是可以断定华为从事违反美国国家安全或外交政策利益的活动的信息。这些信息包括美国司法部对华为的公开起诉书中所指控的活动，包括华为涉嫌违反《国际紧急经济权力法》（IEEPA）、以及密谋违反IEEPA向伊朗提供被禁金融服务，以及在美国政府调查这些涉嫌违反美国制裁的行为时妨碍司法。
数据保护官（DPO）社群主要成员是个人信息保护和数据安全一线工作者。他们主要来自于国内头部的互联网公司、安全公司、律所、会计师事务所、高校、研究机构等。在从事本职工作的同时，DPO社群成员还放眼全球思考数据安全和隐私保护的最新动态、进展、趋势。2018年5月，DPO社群举行了第一次线下沙龙。沙龙每月一期，集中讨论不同的议题。目前DPO社群已近300人。关于DPO社群和沙龙更多的情况如下：
DPO社群成果
线下沙龙实录见：
人脸识别系列文章
美国联邦隐私保护立法草案研究
美国联邦隐私保护立法草案研究（一）：“行为个性化”
美国联邦隐私保护立法草案研究（二）：“个人敏感信息”
美国联邦隐私保护立法草案研究（三）：“个人敏感信息”的保护规则
美国联邦隐私保护立法草案研究（四）：“生物识别信息”
传染病疫情防控与个人信息保护系列文章
个人数据与域外国家安全审查系列文章
美国电信行业涉及外国参与的安全审查系列文章
美国电信行业涉及外国参与的安全审查（一）：基本制度介绍
美国电信行业涉及外国参与的安全审查（二）：国际性的第214节授权
美国电信行业涉及外国参与的安全审查（三）：建立外国参与安全审查的行政令
美国电信行业涉及外国参与的安全审查（四）：FCC对中国企业的陈述理由令
中国的网络安全审查系列文章：
第29条工作组/EDPB关于GDPR的指导意见：