MOROCCO Law and Practice Contributed by: Mehdi Kettani, Adil Mouline, Othman Sentissi and Kawtar Mouti, DLA Piper Casablanca
DLA Piper Casablanca CFC Cube Tower Casablanca Finance City Casablanca Morocco Tel: +212 520 427 827 Email: sara.essouar@dlapiper.com Web: www.dlapiper.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Law No 09-08 on the protection of individuals with regard to the processing of personal data and its implementing Decree No 2-09-165 govern personal data in Morocco. This law applies to personal data processing: • when it is carried out by a natural or legal person established in Moroccan territory; and • when the data controller is not established in Moroccan territory but uses automated or non- automated means to process personal data in Moroccan territory (except any processing which is used solely for purposes of transit in national terri - tory, or in a country where the legislation is recog - nised as equivalent to that of Morocco with regard to the protection of personal data). The regulatory authority in charge of personal data protection in Morocco, the National Commission for the Control of Personal Data Protection ( Commission Nationale de Contrôle de Protection des Données à Caractère Personnel – CNDP), issues decisions that provide specifications regarding types of processing to simplify the notification requirements and stand - ardise the processing of personal data. Data control - lers and processors are required to comply with these decisions. Although Morocco does not yet have AI- specific regulations, the CNDP is currently preparing a decision on AI and personal data.
Data in Morocco is also regulated by Law No 05-20 relating to cybersecurity. This law contains provisions applicable to all data, including but not limited to personal data, processed by specific types of data controllers, such as public entities and critical infra - structures. In addition to these laws, the EU GDPR and other foreign data protection regulations may apply to some entities in Morocco if the processing conducted by these entities falls within the scope of the regulation in question. 1.2 Rights and Obligations Moroccan data protection law is built around a set of core principles that shape all personal data process - ing. Controllers must ensure that data is collected for legitimate purposes, remains proportionate to those purposes, is kept accurate and up to date, and is not retained longer than necessary. Processing typically requires the individual’s free, specific and informed consent, except in rare cases allowed by law. Organi - sations are also required to put in place appropriate technical and organisational safeguards to protect personal data, with reinforced measures when deal - ing with sensitive personal data. Individuals are granted a broad range of rights ena - bling them to understand and control how their per - sonal data is used. These include the right to be informed at the time of collection, the right to access their data, the right to request rectification or deletion of inaccurate or unlawful data, and the right to object to the processing of their data.
329 CHAMBERS.COM
Powered by FlippingBook