Morocco's Law no. 09-08 on the protection of individuals with regard to the processing of personal data incorporates a national security and law enforcement exemption, limiting the law's applicability in specific circumstances related to state security and criminal investigations.

Text of Relevant Provisions

Loi 09-08 Art.2(2)(3)(2):

"This law does not apply to: Personal data collected and processed in the interest of national defense and internal or external state security. It applies to personal data collected and processed for the prevention and prosecution of crimes and offenses only under the conditions established by the law or regulation that creates the relevant file. This regulation specifies the data controller, the legitimacy condition of the processing, the purpose(s) of the processing, the category or categories of data subjects, the data or categories of data related to them, the origin of this data, the third parties or categories of third parties to whom this data may be communicated, and the measures to be taken to ensure the security of the processing. It is subject to the prior opinion of the National Commission."

Original (French):

"La présente loi ne s'applique pas : aux données à caractère personnel collectées et traitées à des fins de défense nationale et de sûreté intérieure ou extérieure de l'Etat. Elle ne s'applique aux données à caractère personnel collectées et traitées à des fins de prévention et de répression des crimes et délits que dans les conditions fixées par la loi ou le règlement qui crée le fichier concerné. Ce règlement précise le responsable du traitement, la condition de légitimité du traitement, la ou les finalités du traitement, la ou les catégories de personnes concernées, les données ou catégories de données s'y rapportant, l'origine de ces données, les tiers ou catégories de tiers auxquels ces données peuvent être communiquées et les mesures à prendre pour assurer la sécurité du traitement. Il est soumis à l'avis préalable de la Commission nationale."

Analysis of Provisions

The national security and law enforcement exemption in Morocco's data protection law is primarily addressed in Article 2(2)(3)(2) of Law no. 09-08. This provision establishes two distinct categories of exemptions:

1. Absolute exemption: The law explicitly states that it "does not apply to personal data collected and processed in the interest of national defense and internal or external state security" ("ne s'applique pas aux données à caractère personnel collectées et traitées à des fins de défense nationale et de sûreté intérieure ou extérieure de l'Etat"). This exemption is absolute, meaning that data processing activities falling under this category are entirely outside the scope of the data protection law.
2. Conditional exemption: For "personal data collected and processed for the prevention and prosecution of crimes and offenses" ("données à caractère personnel collectées et traitées à des fins de prévention et de répression des crimes et délits"), the law applies, but only under specific conditions. These conditions must be established by the law or regulation that creates the relevant file.

The provision further elaborates on the requirements for the regulation governing the conditional exemption. It must specify:

• The data controller
• The legitimacy condition of the processing
• The purpose(s) of the processing
• The category or categories of data subjects
• The data or categories of data related to them
• The origin of this data
• The third parties or categories of third parties to whom this data may be communicated
• The measures to be taken to ensure the security of the processing

Additionally, this regulation is subject to the prior opinion of the National Commission, which adds an extra layer of oversight to ensure that the exemption is not misused.

Implications

The national security and law enforcement exemption in Morocco's data protection law has several important implications:

1. Broad national security exemption: Data controllers involved in national defense and state security activities have significant latitude in their data processing activities, as they are entirely exempt from the law's requirements.
2. Limited law enforcement exemption: While law enforcement agencies have some exemptions for crime prevention and prosecution, they must still adhere to specific regulations and oversight mechanisms.
3. Regulatory framework: The conditional exemption for law enforcement requires a detailed regulatory framework, ensuring transparency and accountability in data processing for these purposes.
4. Oversight role: The National Commission plays a crucial role in overseeing the application of the conditional exemption, providing an additional safeguard against potential misuse.
5. Balancing act: The law attempts to strike a balance between national security interests and individual privacy rights, providing complete exemptions in some areas while maintaining regulatory oversight in others.
6. Compliance considerations: Organizations working with Moroccan law enforcement or security agencies must carefully consider whether their data processing activities fall under these exemptions and, if so, what specific requirements apply.
7. Potential for abuse: The broad exemption for national security purposes could potentially be misused to circumvent data protection requirements, highlighting the importance of robust democratic oversight mechanisms.