Law no. 09-08 on the protection of individuals with regard to the processing of personal data in Morocco extends its applicability to data controllers not established in Morocco but using equipment located within the country for data processing purposes.

Text of Relevant Provisions

Loi 09-08 Art.2(2)(1)(b):

"1. This law applies to the processing of personal data as defined in paragraph 1 above in the following cases:

b) When the data controller is not established on Moroccan territory but uses automated or non-automated means, located on Moroccan territory, for the purpose of processing personal data, excluding processing used solely for transit within the national territory or the territory of a state whose data protection legislation is recognized as equivalent to that of Morocco."

Analysis of Provisions

Article 2(2)(1)(b) of Law 09-08 establishes the law's applicability based on the use of equipment within Morocco's territory. This provision contains several key elements:

1. It applies to data controllers "not established on Moroccan territory", extending the law's reach beyond national borders.
2. The law covers the use of "automated or non-automated means" for data processing, encompassing a wide range of technologies and methods.
3. These means must be "located on Moroccan territory", clearly defining the geographical scope of this provision.
4. The purpose of using these means must be "for the purpose of processing personal data", linking the equipment use directly to data processing activities.
5. An exception is made for "processing used solely for transit" within Morocco or through a country with equivalent data protection laws, indicating that mere data transmission does not trigger the law's applicability.

The rationale behind this provision is to ensure comprehensive protection of personal data processed within Morocco's borders, regardless of the data controller's location. This approach prevents companies from circumventing Moroccan data protection laws by simply locating their operations outside the country while still processing data within Morocco.

Implications

The equipment-based applicability of Law 09-08 has several important implications for businesses:

1. Foreign companies using any form of equipment in Morocco for data processing must comply with the law, even if they have no formal establishment in the country.
2. The law applies to both automated (e.g., servers, cloud services) and non-automated (e.g., paper files) means of data processing located in Morocco.
3. Companies must assess whether their use of equipment in Morocco goes beyond mere data transit, as this could trigger the law's applicability.
4. Foreign businesses processing data of Moroccan residents might need to review their data processing activities and infrastructure to determine if they fall under this provision.
5. Organizations may need to implement measures to ensure compliance with Moroccan data protection requirements when using equipment within the country.
6. The provision may impact cloud service providers and data centers located in Morocco, as their services could be considered "means" used by foreign controllers for data processing.
7. Companies not established in Morocco but using equipment there for data processing must appoint a representative in Morocco, as stated in Article 2(2) of the law.
8. The exception for data transit may provide some flexibility for international data transfers passing through Morocco, provided they meet the specified conditions.

This equipment-based approach to territorial scope aligns Morocco's data protection framework with international standards, ensuring that data processing activities within the country's borders are subject to its laws, regardless of the controller's location. It also emphasizes the importance of considering the physical location of data processing equipment in determining regulatory compliance obligations.