MOROCCO Law and Practice Contributed by: Mehdi Kettani, Adil Mouline, Othman Sentissi and Kawtar Mouti, DLA Piper Casablanca
2. Privacy Litigation 2.1 Privacy Litigation Overview
Cybersecurity on the other hand falls under the scope of a different regulator, which is the Informa - tion Systems Security Department within the Ministry of Defence. This regulator is in charge of monitoring, providing guidance and receiving complaints relating to the information systems security of entities that are within the scope of Law No 05-20 on cybersecurity. 1.8 Enforcement Proceedings and Fines The CNDP has the authority to investigate incidents related to the protection of personal data, and to refer cases to the public prosecutor to initiate proceedings against any suspected offender. In addition to police officers, specially commissioned and duly sworn offic - ers of the CNDP may search for and formally record violations in official reports. Non-compliance with Law No 09-08 on the protection of individuals with regard to the processing of person - al data is subject to a fine ranging from MAD10,000 to MAD600,000 and/or imprisonment of between three months and four years. The CNDP typically sends a warning to the data controller prior to any measure that may result in a fine or imprisonment. In addition to these fines, legal persons may be pun - ished with one of the following penalties: • the partial confiscation of their property; or • seizure of objects and items where the produc - tion, use, carrying, holding or selling of such is an offence; or • the closure of the establishment(s) of the legal per - son where the offence was committed. 1.9 Enforcement Trends The CNDP has addressed warning letters to some entities that process large amounts of personal data and/or sensitive personal data. Most of these warn - ings have been addressed to data controllers such as hotels, pharmaceutical companies, public universities, and other public entities.
Privacy-related litigation in Morocco remains limited, reflecting both the still-developing nature of data protection awareness and the fact that the national authority acts mainly as an educator at this stage. Individuals may file complaints when their rights to access, rectify or object are denied, and the data protection authority has the power to order correc - tive measures or refer cases to the public prosecutor for potential criminal proceedings. As a result, many disputes are resolved at the administrative stage, with formal court proceedings arising only when the matter escalates into a criminal offence. 2.2 Recent Case Law There is no major privacy-related case law in Morocco due to the limited number of litigation cases related to the subject. Examples of recent court cases do however illustrate an emerging awareness. In one instance, individuals who had been filmed without their consent during the shooting of a movie were awarded damages in court. In another instance, an individual appeared in a com - pany’s promotional magazine without having given prior consent and successfully obtained damages in court. 2.3 Collective Redress Mechanisms There are no privacy-specific collective redress mech - anisms in Morocco. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Morocco does not have any non-personal data spe - cific law. The main law that can apply to both personal and non‑personal data in Morocco is Law No 05‑20 on cybersecurity. It applies to the sensitive informa - tion systems owned by a public entity or a critical infrastructure.
331 CHAMBERS.COM
Powered by FlippingBook