MOROCCO Law and Practice Contributed by: Mehdi Kettani, Adil Mouline, Othman Sentissi and Kawtar Mouti, DLA Piper Casablanca
To achieve compliance in practice, organisations should implement the following measures: • map all data-processing activities; • ensure that all processing activities are conducted within the limits permitted under Moroccan law and regulations; • ensure that the documentation (eg, information notices and data protection clauses) used in the context of each processing is compliant with the applicable regulations; • complete mandatory filings with the CNDP or obtain prior authorisations where required, includ - ing for sensitive data, changes of purpose or interconnections; • enter into written contracts with data processors that clearly define security, confidentiality and instruction-bound obligations; and • implement data retention rules consistent with the purpose of processing. 1.3 Special Categories of Personal Data Moroccan law imposes enhanced safeguards when processing sensitive personal data, which includes data relating to a person’s ethnic or racial origin, political or religious beliefs, trade union membership, health status or genetic characteristics. This data may only be processed under strict conditions and typi - cally requires explicit consent, and prior authorisation from the data protection authority, given its heightened potential to impact individual rights and freedoms. 1.4 Processing of Personal Data for Research and Development Purposes In Morocco, there are no specific regulations govern - ing the processing of personal data for research and development purposes. As a result, the general data protection rules apply. That said, where anonymisa - tion is effective and the individual is no longer identifi - able from the data, the dataset no longer constitutes personal data. In those circumstances, it falls outside the scope of data protection law and may be used without prior authorisation. Additionally, at the request of the data controller and where a legitimate interest exists, the data protection authority may authorise the retention of personal data for historical, statistical or scientific purposes beyond
the period necessary for achieving the initial purposes of collection. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Morocco does not yet have a dedicated regulatory framework governing artificial intelligence, automated decision-making or algorithmic systems. As a result, any use of personal data in AI models must comply with the general principles of lawfulness, purpose limi - tation, proportionality and accuracy that apply to all processing activities under Moroccan data protection law. The CNDP is currently preparing a decision that should bring more clarity to the future of AI and per - sonal data in Morocco. 1.6 Data Breach Requirement Moroccan data protection law requires controllers to implement technical and organisational measures that ensure the security of personal data and protect it against unauthorised access, alteration, disclosure, accidental loss or destruction. These obligations form the foundation of how organisations must pre - vent data breaches. When a data breach occurs, data controllers and data processors are not required to notify the data protection authority about it under the applicable regulations. That said, notifying the data protection authority about a data breach would be highly recommended. 1.7 Regulators The CNDP is the only personal data protection regula - tor in Morocco. The CNDP has jurisdiction over any and all data controllers and data processors that are subject to Law No 09-08 on the protection of individu - als with regard to the processing of personal data. The CNDP has focused, for over a decade, on famil - iarising stakeholders with the applicable data protec - tion regulations. Over the last few months, the CNDP has started to issue warnings to some major data controllers in Morocco, asking them to comply with the provisions of Law No 09-08. The CNDP has also initiated some investigations into potential violations of the applicable regulations, specifically by data con - trollers that process significant amounts of personal data.
330 CHAMBERS.COM
Powered by FlippingBook