MoroccoLaw No. 09-08, rights of the data subject
Loi n° 09-08, arts. 5-10 (droits de la personne concernée)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdfIn force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Before or when you collect personal data directly from the data subject, tell them, expressly, precisely, and unambiguously, your identity, the purposes of the processing, and, where fair processing requires it, the recipients, whether their response is mandatory, and their access and rectification rights.NIST Privacy FrameworkCM.AW-P1
- Where you did not collect the data from the data subject, give them that same information no later than the first disclosure to a third party, unless they already have it.NIST Privacy FrameworkCM.AW-P1
- On request, confirm to a data subject, at reasonable intervals, without delay and free of charge, whether you are processing their personal data, and tell them the purposes, the categories of data, the recipients, and, where available, the data's origin.NIST Privacy FrameworkCT.DM-P1
- On a data subject's request, update, rectify, erase, or block personal data whose processing does not comply with the law, free of charge, within ten clear days, and notify anyone the data was disclosed to of the correction.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Honor a data subject's objection to processing on legitimate grounds, and their objection, free of charge, to having their data used for marketing by you or by any later processor.NIST Privacy FrameworkCT.PO-P3
- Do not send direct marketing by automated call, fax, or electronic mail to anyone who has not given prior consent, and, for the narrow email exception the law allows to existing customers, always let the recipient opt out, free of charge, of further messages.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 5 to 10 give the data subject a right to be informed at collection, to access, to rectification, erasure or blocking within ten clear days, to object, and to be free of direct marketing without prior consent. They are duties to give information or act on a request; none requires the controller to make, keep or produce a log or record. Article 7 puts the burden of proving that an access request is manifestly abusive on the controller and Article 6(b) has the controller tell the Commission when informing a data subject is impossible; the first is a burden of proof with no record named and the second a notice. No scope clause is cited.
- Kind
- None
- As of
What this law does
Article 5 requires a controller collecting data directly from a data subject to tell them, expressly, precisely and unambiguously, the controller's identity, the purposes of the processing and, where fair processing requires it, the recipients, whether a response is mandatory and the consequences of not responding, the existence of access and rectification rights, and the receipt or authorization the processing rests on; where the data were not collected from the data subject, Article 5(3) requires that information no later than the first disclosure to a third party.
Article 6 exempts national-defense and internal or external state-security processing, cases where informing the data subject proves impossible for statistical, historical or scientific processing, processing a law expressly directs to be recorded or disclosed, and processing for exclusively journalistic, artistic or literary purposes.
Article 7 gives the data subject the right to obtain, at reasonable intervals, without delay and free of charge, confirmation of processing, the data in intelligible form, and the logic underlying an automated treatment of them, letting the controller ask the CNDP for more time or oppose manifestly abusive requests.
Article 8 gives a right to correct, update, erase or block noncompliant data within ten clear days, free of charge, and to have the correction passed on to any third party the data were disclosed to, escalating to the CNDP on refusal or non-response. Article 9 gives a right to object on legitimate grounds, and an unconditional and free right to object to use of the data for prospecting, including commercial prospecting.
Article 10 bars direct marketing by automated call, fax or electronic mail to a person who has not given prior consent, with a narrow exception for email marketing of similar products to a controller's own existing customers, conditioned on an easy, free opt-out being offered at collection and with every message. The law's final and transitional articles state no day of its own for its entry into force.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .