Processes personal data, in Morocco

Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel, promulguée par le Dahir n° 1-09-15 du 22 safar 1430 (18 février 2009), arts. 1-4, 12-20, 23, 25-26, 45-48 (dispositions générales, déclaration et sécurité) · Read the law's page

• Process personal data only where it is collected fairly and lawfully for determined, explicit and legitimate purposes, and do not process it later in a way incompatible with those purposes.
• Keep personal data adequate, relevant, accurate, and not excessive for those purposes, and do not retain it in identifiable form longer than the purposes require.
• Obtain the data subject's unambiguous consent before processing their personal data, unless a legal obligation, contract performance, vital interest, public interest mission, or legitimate interest ground applies.
• File a prior declaration with the CNDP before implementing an automated processing operation, or a set of related automated operations, unless the processing instead requires the CNDP's prior authorization.
• If you are established outside Morocco but use processing means located there, notify the CNDP of the identity of a Morocco based representative who takes on your rights and obligations under the law.
• Implement technical and organizational measures appropriate to the risk and the state of the art, protecting personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, and unauthorized access, including where the processing involves network transmission.
• Bind any processor you use to security guarantees equivalent to your own by contract, and hold anyone with authorized access to personal data, including after they leave that role, to professional secrecy.
• Notify the CNDP without delay of any change to a declared processing's particulars or of ending the processing, so its national register of declared and authorized processing stays current.

Loi n° 09-08, arts. 12(1), 21-22, 24, 49-50 (données sensibles et catégories protégées) · Read the law's page

• Do not process sensitive data, meaning data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data including genetic data, without a specific legal authorization, the CNDP's prior authorization, or the data subject's express consent.
• Where you process health data solely for preventive medicine, medical diagnosis, care, or health service management under a practitioner's or an equally bound person's professional secrecy, file a declaration with the CNDP rather than seeking its prior authorization.
• Where you process sensitive or health data, put in place the heightened technical measures Article 24 lists: control who can enter the processing facility, who can read, copy, modify, or remove the data media, and who can access, transmit, or input the data, and keep a record of what sensitive data was input, when, and by whom.
• Do not process personal data about offenses, criminal convictions, or security measures unless you are a court, a public authority, a public service body, or an auxiliary of justice acting within your legal duties.

Loi n° 09-08, arts. 27-42, 51-66 (Commission nationale, sanctions) · Read the law's page

• Cooperate with the CNDP's investigations, give its commissioned agents access to your processing facilities, data, and documents, and comply with any order it issues to correct, block, erase, or destroy data, or to suspend or halt a processing operation.
• Comply at once with a CNDP decision withdrawing your declaration receipt or authorization because your processing threatens public security or order or offends morality.
• Expect a fine of 10,000 to 100,000 dirhams for processing personal data without the required declaration or authorization, or for continuing after your receipt or authorization is withdrawn.
• Expect a fine of 20,000 to 200,000 dirhams per infraction, and for several of these the same fine plus imprisonment of three months to one year, for refusing an access, rectification, or objection request, collecting data unlawfully, processing beyond the declared purpose, keeping data past its retention period, processing without the required consent, running inadequate security measures, disregarding a legitimate objection, or transferring data abroad unlawfully.
• Expect imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the highest tier the law sets, for processing sensitive data or offense and conviction data without the required consent or authorization, doubled if you are a legal person and doubled again if you offend again within a year.

Loi n° 09-08, arts. 43-44 (transfert de données vers un pays étranger) · Read the law's page

• Do not transfer personal data to a foreign country unless that country appears on the CNDP's list of states that ensure a sufficient level of protection.
• Where the destination country is not on that list, transfer personal data only with the data subject's express consent, under one of the Article 44 necessity grounds, under a bilateral or multilateral agreement Morocco is party to, or with the CNDP's own express and reasoned authorization.

Loi n° 09-08, arts. 5-10 (droits de la personne concernée) · Read the law's page

• Before or when you collect personal data directly from the data subject, tell them, expressly, precisely, and unambiguously, your identity, the purposes of the processing, and, where fair processing requires it, the recipients, whether their response is mandatory, and their access and rectification rights.
• Where you did not collect the data from the data subject, give them that same information no later than the first disclosure to a third party, unless they already have it.
• On request, confirm to a data subject, at reasonable intervals, without delay and free of charge, whether you are processing their personal data, and tell them the purposes, the categories of data, the recipients, and, where available, the data's origin.
• On a data subject's request, update, rectify, erase, or block personal data whose processing does not comply with the law, free of charge, within ten clear days, and notify anyone the data was disclosed to of the correction.
• Honor a data subject's objection to processing on legitimate grounds, and their objection, free of charge, to having their data used for marketing by you or by any later processor.
• Do not send direct marketing by automated call, fax, or electronic mail to anyone who has not given prior consent, and, for the narrow email exception the law allows to existing customers, always let the recipient opt out, free of charge, of further messages.