As a rule, no. Your personal data may only be processed if you have unambiguously given your consent to the intended operation (art. 4). Likewise, your data may only be disclosed to a third party for purposes directly related to the functions of the transferor and the transferee, and subject to your prior consent (art. 4).
The exceptions where your consent is not required. Article 4 provides that consent is not required where processing is necessary:
- to comply with a legal obligation imposed on you or on the data controller;
- for the performance of a contract to which you are a party, or for pre-contractual measures taken at your request;
- to safeguard your vital interests if you are unable to give consent;
- for a task in the public interest or in the exercise of public authority;
- to pursue the legitimate interest of the controller or the recipient, provided this does not override your fundamental rights and freedoms.
Consent is a free, specific and informed expression of will by which you accept the processing (art. 1, point 9). So, outside these specific cases, a company that exploits your data without your consent is not complying with the law.
This is general legal information, not legal advice. For advice on your specific situation, consult a lawyer admitted to the Bar in Morocco.