I thought this law had been initiated by Macron, but it's from 2004, before his first mandate.

Failing to file a declaration for cryptology services used for confidentiality can result in up to 2 years in jail and 30k€ fine.

art. 35 "III. - Le fait de fournir des prestations de cryptologie visant à assurer des fonctions de confidentialité sans avoir satisfait à l'obligation de déclaration prévue à l'article 31 est puni de deux ans d'emprisonnement et de 30 000 Euros d'amende." 

 oops, I wrote "up to 2 years in jail" but it's actually "2 years in jail" 

 Where do the other18 years come from? or are they just rounding up to 20 years? 

 2 years is only for one item in the list. By summing up the potential jail time for each "crime", I suppose you should get to approx 20 years.