Personal data protection in Morocco: your rights and the CNDP (Law 09-08)
Law 09-08 protects your personal data in Morocco. It sets out a simple principle: information technology serves the citizen and must not infringe upon your identity or your rights, nor disclose the secrets of your private life (art. premier). This guide explains what the law protects, which rights you can exercise, and the role of the National Commission (the CNDP).
What the law protects
"Personal data" means any information relating to an identified or identifiable natural person, including sound and image (art. premier). "Processing" covers almost every possible operation: collection, recording, storage, use, communication, erasure, and so on (art. premier).
The law also distinguishes "sensitive data": data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data, including genetic data (art. premier). Such data benefit from enhanced protection.
The law applies to automated processing as well as to manual files, provided that the controller is established in Morocco or uses means located on Moroccan territory (art. 2). It does not apply to purely personal or domestic activities, nor to certain processing related to national defence and State security (art. 2).
The rules that anyone processing your data must follow
The "data controller" is the person who determines the purposes and means of the processing (art. premier). They must ensure that your data are:
- processed fairly and lawfully;
- collected for specified, explicit and legitimate purposes;
- adequate, relevant and not excessive;
- accurate and, where necessary, kept up to date;
- retained for no longer than is necessary for the purposes (art. 3).
In principle, processing is only possible if you have unambiguously given your consent (art. 4). This consent is not required, however, in certain cases, for example to comply with a legal obligation, to perform a contract to which you are a party, or to safeguard your vital interests (art. 4).
Your rights
Law 09-08 grants you several rights that you can exercise directly with the data controller.
The right to information
When your data are collected from you, you must be informed in an express, precise and unambiguous manner: the identity of the controller, the purposes of the processing, the recipients, whether replies are mandatory or optional, and the existence of your rights of access and rectification (art. 5). This obligation is subject to limits, in particular for national defence or for processing carried out solely for journalistic, artistic or literary purposes (art. 6).
The right of access
Upon proof of your identity, you may obtain, at reasonable intervals, without delay and free of charge: confirmation that your data are being processed, their communication in an intelligible form, and even knowledge of the logic underlying any automated processing (art. 7).
The right of rectification
You may request the updating, rectification, erasure or blocking of data that do not comply with the law, in particular data that are incomplete or inaccurate. The controller must do so free of charge, within a clear period of ten days. In the event of a refusal or no response, you may refer the matter to the National Commission (art. 8).
The right to object
You may object, on legitimate grounds, to the processing of your data. You may also object, free of charge, to their use for marketing purposes, in particular commercial marketing (art. 9).
Commercial marketing: a strict framework
Direct marketing by automated calling systems, fax or electronic mail is prohibited without your prior consent (art. 10). An exception exists for email if your contact details were collected during a sale, for similar products, and provided you can object simply and free of charge (art. 10). In all cases, the sender may not conceal their identity (art. 10).
Furthermore, no decision producing legal effects with respect to you may be taken solely on the basis of automated processing intended to profile or evaluate your personality (art. 11).
Formalities: declaration or authorisation
Before implementing a processing operation, the controller must complete formalities with the National Commission. Depending on the case, this involves:
- a prior authorisation, in particular for sensitive data, genetic data, offence-related data, or the national identity card number (art. 12);
- a prior declaration in other cases (art. 12).
The declaration includes specific details (the identity of the controller, the purposes, the categories of data, the recipients, the retention period, the security measures, and so on) (art. 15). The Commission issues a receipt within 24 hours, and the processing may then begin (art. 19). The processing of sensitive data is subject to authorisation by law or, failing that, by the National Commission (art. 21).
Security and confidentiality
The controller must implement appropriate technical and organisational measures to protect your data against loss, alteration or unauthorised access (art. 23). For sensitive or health data, enhanced controls apply (control of access, of media, of transmission, and so on) (art. 24). Anyone processing your data is also bound by professional secrecy, even after their duties have ended (art. 26).
The role of the CNDP
The National Commission for the Control of the Protection of Personal Data is established within the office of the Prime Minister (art. 27). It ensures compliance with the law: it issues opinions, receives declarations and delivers receipts (art. 27), examines authorisations (art. 28) and informs the public of their rights (art. 29). It has genuine powers of investigation and may order the blocking, erasure or prohibition of a processing operation (art. 30).
You may file a complaint with it if you believe you have been harmed by the processing of your data; it may order corrections or refer the matter to the Crown Prosecutor (art. 28).
Transfers of data abroad
Your data may only be transferred to a foreign State if that State ensures an adequate level of protection (art. 43). Failing that, the transfer remains possible in specific cases, for example with your express consent or on the reasoned authorisation of the National Commission (art. 44).