Page 1

Deliberation n ° 009-2012 of July 13, 2012 identifying the
processing of personal data excluded from the scope of
Law 09-08 in accordance with paragraph 3, paragraph 4 of article 2.

The National Commission for the Control of Personal Data Protection,
met on July 13, 2012, under the chairmanship of Mr. Saïd Ihraï;
Were present Mrs. Souad El Kohen, Messrs Driss Belmahi, Abdelaziz Benzakour and
Omar Seghrouchni;
Considering Law n ° 09-08, promulgated by Dahir 1-09-15 of February 18, 2009, relating to the
of natural persons with regard to the processing of personal data (BO n °
5714 of 05/03/2009);
Considering the Decree n ° 2-09-165 of May 21, 2009 taken for the application of the aforementioned Law n ° 09-08
(BO n ° 5744 of 06/18/2009);
Having regard to the Internal Regulations of the CNDP (approved by decision of the Prime Minister n ° 3-33-11
of March 28, 2011 / BO n ° 5932 of 04/07/2011);
Raised the question of the interpretation to be given to the content of subparagraph 3, paragraph 4 of
article 2 which states that Law 09-08 does not apply to "personal data
collected in application of specific legislation. "
The answer to this question makes it possible to determine more precisely the scope of
Law 09-08 and consequently the regime applicable to the processing to be notified to the
CNDP.
In interpreting this paragraph, the Commission is based on the following rationale:
1. In delimiting the scope of Law 09-08, the CNDP notes the
distinction made between “processing” and “data collected”. So,

1
Building Patios, Bd Annakhil, 3 th floor, Hay Ryad Rabat
Phone. (212) 537 57 11 24 - Fax (212) 537 57 21 41
Email contact@cndp.ma

Page 2

- Paragraph 1, paragraph 4 of article 2 excludes from the scope of the law "the
processing of personal data carried out by a natural person
for the exercise of exclusively personal or domestic activities ”;
- Paragraph 2, paragraph 4 of article 2 excludes from the scope of the law
"personal data collected and processed in the interest of the defense
national and internal or external security of the State. "
- This same paragraph provides that the law "does not apply to personal data
collected and processed for the purposes of prevention and repression of crimes and misdemeanors
that under the conditions fixed by the law or the regulation which creates the file in question;
this regulation specifies the controller, the condition of legitimacy of the
processing, the purpose (s) of the processing, the category (s) of persons
concerned and the data or categories of data relating thereto, the origin of
this data or the third parties or categories of third parties to whom this data may be
communicated and the measures to be taken to ensure the security of the processing. It is
subject to the prior opinion of the National Commission ”;
- Paragraph 3, paragraph 4 of article 2 excludes from the scope of the law
"personal data collected in application of legislation
particular. "The expression" collect ", besides the fact that it is not associated, in
this case, to that of "treatment", refers, according to the definition of this term, to two
types of operations, namely, collection and registration.
It follows from this distinction established by law in paragraph 3 of article 2, that only
two types of operations, namely "collecting" and "recording", are excluded from the
scope of the law. This distinction is maintained throughout the
operative part of the law, which is directly inspired by Convention 108 of the Council
from Europe.
It follows that as soon as there is implementation of another operation, apart from the
collection and recording of data, such as ", organization,
conservation, adaptation or modification, extraction, consultation,
the use, communication by transmission, broadcast or any other form of
provision, reconciliation or interconnection, as well as locking,
erasure or destruction ”, this is subject to law.

2
Building Patios, Bd Annakhil, 3 th floor, Hay Ryad Rabat
Phone. (212) 537 57 11 24 - Fax (212) 537 57 21 41
Email contact@cndp.ma

Page 3

It should be noted that all operations, apart from those related to the
collection of personal data, are part of the processing operation and are
subject, therefore, to the control of the CNDP.
Furthermore, this exclusion does not exempt the data controller from ensuring
that the conditions of the "collection" of the data are respected by the determined entity
by law (controller), respecting:
• the purpose determined by law;
• the rights of the data subject;
• the principle of the proportionality of the data collected with regard to
purposes for which they are collected;
• measures taken to ensure the security and confidentiality of
data collected.
2. Article 18 of Law 09-08 relating to the exemption from declaration for treatments having
the sole purpose of keeping a public register confirms this interpretation since
provides that “The reporting obligation does not apply to processing operations intended to
sole purpose of keeping a register which, by virtue of legislative provisions or
regulatory, intended for public information and open to public consultation
or any person showing a legitimate interest. This provision implies, by
default, that the reporting obligation applies to processing operations which by virtue of
legislative or regulatory provisions, do not have as their sole purpose the holding of a
public register intended for public information. Consequently, the obligation to
declaration applies to treatments that are provided for by legislative provisions
or regulatory, i.e. processing carried out in application of legislation
particular.
On the basis of the above, the Commission accepts the following interpretation of paragraph 3,
paragraph 4 of article 2:
Are considered personal data collected in application of a
specific legislation, any collection and / or recording of personal data
carried out in application of specific legislation, on the other hand any "processing" of these
data is subject to the provisions of Law 09-08, outside of course the cases
exclusion provided for in paragraphs 1 and 2 of paragraph 4 of article 2 of the law.

3
Building Patios, Bd Annakhil, 3 th floor, Hay Ryad Rabat
Phone. (212) 537 57 11 24 - Fax (212) 537 57 21 41
Email contact@cndp.ma

Page 4

Any additional processing carried out in this context, apart from the collection and / or
the recording of personal data, is therefore fully subject to the field
law enforcement.
It follows that in accordance with article 67 of law 09-08, the data controllers who
act in application of specific legislation must also take all
provisions necessary to comply with the law for any processing carried out, outside of
the simple collection and recording of personal data. They dispose
a maximum period of two years, starting from the date of installation of the Commission
that will be established by an administrative act published in the Official Bulletin, for
regularize their situation in accordance with the provisions of this law. In the absence of this
regularization within the aforementioned period, their activities are deemed to be carried out without declaration or
without authorization. The offender is exposed, in this case, to the penalties provided for by this
law. "

Done in Rabat, on 07/13/2012

President
Said Ihrai

4
Building Patios, Bd Annakhil, 3 th floor, Hay Ryad Rabat
Phone. (212) 537 57 11 24 - Fax (212) 537 57 21 41
Email contact@cndp.ma

