Page 1

Decision n ° D-107-EUS / 2020 of 23/04/2020 governing teleworking in the
Customer Relations in a state of health emergency - Covid-19.
The CNDP (National Commission for the Protection of Personal Data
Staff),
Under the chairmanship of Mr. Omar Seghrouchni;
Taking into consideration the observations of the members, Ms. Souad El Kohen,
Messrs Driss Belmahi, Abdelaziz Benzakour, Brahim Bouabid;
Considering article 24 of the Constitution of the Kingdom which provides that: “Everyone has the right to
protection of his privacy ”;
Having regard to Convention No. 108 of the Council of Europe for the protection of individuals with regard to
automated processing of personal data to which the Kingdom of Morocco
joined on 05/28/2019;
Considering the law n ° 09-08 promulgated by the Dahir 1-09-15, of February 18, 2009, relating to the
protection of individuals with regard to the processing of personal data
personnel (BO n ° 5714 of 03/05/2009);
Considering the law n ° 65-99 relating to the labor code (BO n ° 5210 of May 06, 2004);
Considering Decree n ° 2-09-165 of May 21, 2009 taken for the application of the aforementioned law n ° 09-08
(BO n ° 5744 of 06/18/2009);
Having regard to Decree-Law n ° 2.20.292 enacting specific provisions for the State of Emergency
Sanitary and measures of its declaration;
Having regard to Decree No. 2.20.293 declaring a state of health emergency throughout the
National Territory in order to stop the spread of the Coronavirus "Covid-19";
Having regard to Decree No. 2.20.330 relating to the extension of the duration of the state of health emergency on
the whole of the National Territory in order to stop the spread of the Coronavirus "Covid-19";
Considering Decree No. 2-12-262 of July 10, 2012 setting the hygiene rules applicable to employees
working at home as well as the obligations incumbent on employers enforcing
home work;
Having regard to the Internal Regulations of the CNDP (approved by decision of the Prime Minister n ° 3-33-11
of March 28, 2011 / BO n ° 5932 of 04/07/2011);
Having regard to the observations of Messrs Driss Belmahi and Brahim Bouabid, rapporteurs appointed by
the Commission,
The National Commission observes that due to the state of health emergency and in order to fight
against the spread of covid-19, employers are using teleworking to ensure
continuity of their activities.

1

Page 2

The use of teleworking generates certain data processing needs
unauthorized personnel in normal situation.
Taking into account the particularities of this health crisis situation, the CNDP (Commission
National Protection of Personal Data) authorized by exception,
during this emergency period, certain treatments in order to allow employers to
Customer Relations sector, to ensure the best compromise between:
• Preserving the state of health of their employees.
• Maintaining economic activity and business relations with their donors
national and international.
• The protection of personal data and the privacy of their
employees and subcontractors.
Also the CNDP, with regard to the concept of telework , considers that:
- teleworking is understood to mean any form of work organization which is carried out in
outside the premises of the company by means of Information Technologies and
Communication ;
- a teleworker is the person who carries out his activities in
teleworking;
- for the exercise of teleworking, two scenarios arise in terms of
equipment deployed:
▪ the employer is the owner of the IT tools;
▪ the teleworker uses his own IT tools.
Thus, the development of a telework charter which can be an amendment to the charter
IT seems essential to lay the foundations for a unified teleworking regime in the
within the company while defining the rights and obligations of stakeholders.
Regarding data controllers , the CNDP considers that the principles laid down by
this deliberation applies to organizations and entities in the customer relations sector
subject to the provisions of the labor code which use for the maintenance of their
teleworking activities during this period of health crisis.
Finally, for certain treatments, the CNDP considers that in this situation of health crisis, and
to ensure the management of teleworking and the maintenance of economic activity, the legality of
collection of personal data is based on:

2

Page 3

• The legitimate interest of the data controller in the event that he is the owner of the
IT tools. It should be noted that the employer is required to inform his
employees of the characteristics of the intended treatment.
• The consent of the teleworker who uses his own IT tools.
In both cases, the employer remains responsible, as must be mentioned in the
teleworking charter, the security of the technical circulation of personal data
personnel and the confidentiality of their treatment.
Under these conditions and in view of the above:
It being understood that the employer is required to duly inform his employee of all his rights,
the CNDP decides to authorize on a case-by-case basis, for the monitoring of the activities of employees in
teleworking, after examining the notification file for the treatment envisaged, and depending on
guarantees provided by the controller, the following:
▪ communication of the personal data of the teleworker, in particular
its telephone number and physical address to third-party companies to ensure
the conditions of teleworking;
▪ Webcam recordings during teleworking windows for dissuasive purposes
and fraud prevention, in an unsystematic and non-generalized manner, and
in the unique situation where the employer owns the teleworking tools;
▪ screenshots, considered as traces of application logs type, of
in an unsystematic and non-generalized manner, and in the unique situation where the employer
owns the teleworking tools.
Rabat, April 23, 2020
Omar Seghrouchni
President of the CNDP

3

Page 4

4

