The Spanish Government opposes the Cybersecurity Act (CSA) currently being drafted in Brussels empowering the European Commission (EC) to designate so-called High-Risk Vendors (HRVs). In practice, this would mean banning Chinese telecommunications equipment providers, such as ZTE and especially Huawei, from European telecom infrastructures.
The European Commission’s proposal turns what was previously a recommendation into an obligation: banning Chinese manufacturers from mobile networks, granting a three-year deadline for their replacement. Furthermore, it extends the ban to fixed, satellite, and submarine cable networks, although no deadline has been set so far to replace Chinese equipment in these networks.
National sovereignty versus supranational regulation
At the Telecommunications Council of Ministers held yesterday in Luxembourg, the Spanish representative, Óscar López, Minister for Digital Transformation, pointed out that “Member States must continue to play a role in defining the supply chains of new technologies that affect national security.” This stance means Spain opposes the definition of HRVs being decided at a supranational level by the European Commission, arguing that national states should be the ones to decide who to declare a high-risk provider, as this impacts national security.
Spain’s geopolitical position and alignment
Spain, which has the closest government to China politically within the European Union—with numerous visits to the Asian giant by the Prime Minister and other executive or PSOE authorities in recent years—has refused to deem Huawei or ZTE as high-risk providers or ban them, despite many European countries having done so to a greater or lesser degree. In fact, Prime Minister Pedro Sánchez has on several occasions mentioned Chinese providers like Huawei among the partners for developing 5G in Spain.
Current landscape of restrictions in Europe
Among the European countries that have taken action against Huawei and ZTE in their networks are:
- Total ban (both in radio equipment and the core network where data and operations are processed): United Kingdom, France, Sweden, Denmark, Norway, Luxembourg, Romania, Portugal, Latvia, Lithuania, and Estonia.
- Restrictions in both radio and core: Belgium and Italy.
- Ban restricted only to the core: The Netherlands.
- Currently implementing restrictions: Poland and Germany.
