MOROCCO Trends and Developments Contributed by: Mehdi Kettani, Adil Mouline, Othman Sentissi and Kawtar Mouti, DLA Piper Casablanca
Video surveillance in healthcare establishments The fourth decision issued in 2025 concerns video surveillance inside healthcare establishments. Cam - eras can sometimes play a role in care, for example when constant visual monitoring is necessary for patient safety, but the same cameras can also become intrusive if used without strict limits. The CNDP model applies when a healthcare establishment wants to install a video surveillance system to monitor patients and visitors, and staff who are in contact with these patients and visitors. It limits the processing to specif - ic purposes: surveillance and control of patients, and monitoring interactions between staff and patients and visitors, notably during medical procedures. The framing is significant because it positions the camera system within a care context rather than as a general surveillance tool, while still acknowledging that such processing is sensitive and needs prior authorisation. The safeguards in the healthcare camera model focus strongly on proportionality. Cameras must only be installed in spaces where constant visual monitoring of patients is necessary, or where medical follow-up requires ongoing visual control to ensure the adminis - tration and quality of care. The model also states that installation must not be excessive or intrusive with respect to staff. In particular, it cannot extend to areas reserved for staff and not accessible to patients and visitors, or more broadly, to areas where there is no interaction with patients and visitors. The model also sets a concrete retention rule: recordings should not be kept beyond six months after the patient leaves the establishment, unless another legal rule requires otherwise. Access control logs The fifth decision of 2025 deals with access control in private professional premises, a routine that many people experience without thinking of it as data pro - cessing. A visitor book at reception, a digital check-in system, or an access badge log can all create a record of who entered a place, when, and for what reason. The CNDP model starts by clarifying that any regis - ter or file containing personal data about visitors for access control purposes is personal data processing. It then restricts the acceptable purposes to verifying identity, controlling access, securing the premises and the people and goods inside, keeping time-stamped
entry and exit information, and producing statistics about attendance. These are common sense purpos - es, but the clarification is important because access control logs can otherwise be quietly expanded into broader monitoring tools. The access control model also shows how the CNDP applies data minimisation in a concrete way. It lists the data that may be collected, such as the visitor name, the date and time of the visit, the purpose of the visit, and the service and person visited. It sets a maximum retention period of one year unless another legal rule requires longer. Most strikingly, it addresses identity documents. If a security agent asks to see an identity document to verify identity, the model indicates that the agent has no right to retain the document and no right to make a copy. The CNDP considers keeping an identity card number or copying an identity docu - ment to be excessive and disproportionate for simple access control, which can be satisfied by consultation without retention. What these five decisions have in common Across the five decisions the CNDP repeatedly sets limits on purpose, it narrows what data may be col - lected, it links retention to necessity, and it insists on transparent information to individuals. It also repeat - edly emphasises security and confidentiality and requires that subcontractors offer sufficient guar - antees, often through contractual clauses. Finally, it consistently restricts transfers of personal data abroad without prior authorisation. These are not merely bureaucratic steps. They are practical levers that reduce the chance of misuse and the impact of incidents, and they also help create a shared language of trust between data controllers and data subjects. A decision in preparation on artificial intelligence In addition to these decisions, the CNDP announced on its website that it was preparing a decision on AI and data protection. In the context of prepara - tory work, the authority launched auditions and held meetings with different stakeholders, including politi - cal parties and professionals working on law, data and related subjects, in order to gather views before issuing guidance on this theme. The CNDP approach, as publicly presented, places emphasis on integrity, transparency, fairness and clarity in AI processing
337 CHAMBERS.COM
Powered by FlippingBook