MOROCCO Trends and Developments Contributed by: Mehdi Kettani, Adil Mouline, Othman Sentissi and Kawtar Mouti, DLA Piper Casablanca
choices, and the use of features that allow content to be shared on social networks. At the same time, the CNDP draws a firm line around profiling. If a data controller uses cookie data to build a personal profile of an internet user, such as to determine habits, pref - erences, or behaviour, the activity then requires prior authorisation. The distinction is easy to understand: counting visits and improving a service is one thing, building a profile of a specific person is another. The cookie model also turns general principles into precise limits. It sets a maximum retention period of six months for data collected via cookies, after which the data should be deleted or made anonymous. It also deals with consent in a pragmatic way. The model indicates that consent is not required for every cookie purpose, but it is required for certain uses that are more intrusive or commercially sensitive, notably personalised advertising and social network sharing features. Consent must be expressed through a clear action and collected through simple and accessible means offered by the website. Just as important, refusal must be possible and must be respected. Newsletters A second decision issued in 2025 focuses on news - letters. Many data controllers send newsletters to customers, members, or the general public, and the processing behind this is often standard: collecting a name and contact details, creating mailing lists, and sending information. The CNDP model sets a sim - plified declaration route for this activity as long as the data controller stays within a defined parameter. Under the model, the data may be used to constitute and use address lists for external information or com - munication actions, and to produce statistics related to newsletter campaigns. It is a practical reminder that even common marketing or information activities are still data processing and must follow rules. Here too, the CNDP highlights a difference that mat - ters in terms of public trust – sending information is not the same as analysing people. The model states that using subscriber data to establish a personal profile requires prior authorisation. In other words, if a newsletter becomes a tool to categorise, predict or influence individuals based on their behaviour, it is treated as higher risk. The decision also sets
straightforward obligations that match what people expect from fair communication. Consent should be obtained, whether through a signature on a paper form or a box that a person actively checks online. Subscribers must be able to unsubscribe at any time through a simple mechanism, such as a link in each message. Data should be kept until the person unsub - scribes, which aligns retention with the relationship chosen by the individual rather than with the conveni - ence of the sender. Patient follow-up The third decision of 2025 addresses patient follow- ups, a domain where data is essential and where the stakes are high. Health information can reveal intimate details, and misuse can have serious consequences. The CNDP model is designed as a simplified authori - sation request for processing used to manage and follow patients. It sets a list of purposes closely linked to care: taking medical appointments, monitoring the state of health of patients, medical diagnosis and therapeutic treatment, producing and communicating analysis results to patients or their legal representa - tives, following the patient pathway within healthcare establishments, and using telemedicine technologies for care and follow-up. By framing the purposes so tightly, the model emphasises that health data should be processed first and foremost to deliver care, not as a resource to be repurposed without control. The patient follow-up model also signals that some uses of health data require an even higher level of scrutiny. It states that processing for purposes other than those listed must be subject to specific authorisa - tion. It mentions, among excluded purposes, scientific research that is independent of medical follow-up, as well as the processing of genetic and genomic data. This distinction is important in a context where the line between care and research can become blurred, especially when data can be aggregated and analysed at scale. The model also describes the types of data that may be involved, ranging from identity data and contact details to financial information needed for payment, and of course, medical data concerning the patient’s health status. It insists on obtaining consent, informing patients, ensuring security and confidential - ity, and controlling transfers abroad, reinforcing the idea that sensitivity calls for discipline at each step.
336 CHAMBERS.COM
Powered by FlippingBook