MoroccoLaw No. 09-08, sensitive personal data and offense records
Loi n° 09-08, arts. 12(1), 21-22, 24, 49-50 (données sensibles et catégories protégées)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdfIn force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Security
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not process sensitive data, meaning data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data including genetic data, without a specific legal authorization, the CNDP's prior authorization, or the data subject's express consent.NIST Privacy FrameworkCT.PO-P1
- Where you process health data solely for preventive medicine, medical diagnosis, care, or health service management under a practitioner's or an equally bound person's professional secrecy, file a declaration with the CNDP rather than seeking its prior authorization.NIST Privacy FrameworkGV.PO-P5
- Where you process sensitive or health data, put in place the heightened technical measures Article 24 lists: control who can enter the processing facility, who can read, copy, modify, or remove the data media, and who can access, transmit, or input the data, and keep a record of what sensitive data was input, when, and by whom.NIST Privacy FrameworkPR.AC-P4NIST Privacy FrameworkCT.DM-P8
- Do not process personal data about offenses, criminal convictions, or security measures unless you are a court, a public authority, a public service body, or an auxiliary of justice acting within your legal duties.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
2 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 24(1)(g) makes a controller of sensitive or health data guarantee that it can be verified afterwards which personal data were entered, when, and for whom (the input-control record); the period is left to the sector's own regulation, so no figure is stated. Article 12(1)(a) also exempts a non-profit association from prior authorization only if it can prove the data subject's express consent to the competent authority on its first request; that is a narrow case within the row's Article 12(1). The row cites no scope clause, so no territorial hook is coded.
- Kind
- Explicit
- As of
- Provision
- Article 24(1)(g); Article 12(1)(a)
- Trigger
- personal_data_processing
What this law does
Article 12(1) makes prior CNDP authorization, rather than a mere declaration, the default for processing sensitive data, for using data outside the purpose it was collected for, for genetic data outside medical care, for data on offenses, convictions or security measures, for a national identity card number, and for interconnecting files serving different public or private purposes.
Article 21 conditions that authorization on the data subject's express consent, a legal or statutory duty of the controller, or the Commission's own finding that the processing protects a vital interest, concerns data the data subject has manifestly made public, or is necessary to a legal claim.
Article 22 lets a controller declare rather than seek authorization for health data processed solely for preventive medicine, diagnosis, care or health-service management by a practitioner or another person equally bound by professional secrecy, or to select beneficiaries of a right, benefit or contract they are not otherwise excluded from.
Article 24 requires a controller of sensitive or health data to additionally control entry to the processing facility, control who can read, copy, modify or remove the data media, control unauthorized input, use, access and transmission, and be able to show after the fact what data was input, when and by whom.
Articles 49-50 restrict processing personal data on offenses, convictions or security measures to courts, public authorities and legally competent public bodies, and to auxiliaries of justice acting within the strict needs of their legal mission. The law's sensitive-data definition (Article 1(3)) does not include a biometric, voiceprint or faceprint identifier. The law's final and transitional articles state no day of its own for its entry into force.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .