Civil Law and Personal Data Identity Protection Law in Morocco

1. Introduction

Personal Data and Identity Protection Law in Morocco is an important part of modern civil law because it protects an individual's privacy, personal identity, reputation, dignity and control over personal information.

The development of digital banking, electronic identification, biometric authentication, social media, online transactions, artificial intelligence and government databases has increased the possibility of identity theft, unlawful disclosure, misuse of personal information and digital impersonation.

Morocco's principal legislation in this area is Law No. 09-08 concerning the protection of individuals with regard to the processing of personal data, promulgated by Dahir No. 1-09-15 of 18 February 2009. Its implementing regulation is Decree No. 2-09-165 of 21 May 2009.

cndp.ma+2

The central objective is to ensure that personal information is processed lawfully, fairly and securely without violating an individual's fundamental rights.

2. Constitutional foundation of personal identity protection

The Moroccan Constitution of 2011 provides an important foundation for privacy and identity protection.

Article 24 – Right to privacy

Article 24 recognises the right of every person to the protection of private life. It provides constitutional support against unjustified interference with personal information, private communications and personal identity.

Article 27 – Right to information

Article 27 recognises access to information, subject to legal limitations, including limitations necessary to protect private life and constitutional rights.

Article 22 – Protection of physical and moral integrity

This provision contributes to the protection of personal dignity and integrity, which are relevant when identity information, photographs or biometric characteristics are unlawfully exploited.

These constitutional provisions must be read together with Law No. 09-08 and the applicable civil and criminal legislation.

3. Legal framework under Law No. 09-08

A. Definition of personal data – Article 1

Article 1 defines personal data broadly as information relating to an identified or identifiable natural person, irrespective of its form or medium.

Examples include:

Full name and date of birth.

National identity card number.

Passport and civil registration details.

Residential address and telephone number.

Photographs, videos and voice recordings.

Biometric and genetic information.

Financial and employment information.

Online identifiers and identifiable digital records.

The definition is important because identity protection is not limited to traditional identity documents. Digital information capable of identifying an individual is also protected.

B. Scope of application – Article 2

Law No. 09-08 applies to automated and certain non-automated processing of personal data.

It applies where:

The data controller is established in Morocco.

A foreign controller uses processing means located in Morocco, subject to the statutory exceptions.

Personal information is collected, stored, modified, transmitted or otherwise processed within the law's territorial scope.

This makes the law relevant to Moroccan companies, financial institutions, telecommunications operators, employers, public authorities and digital service providers.

C. Principles governing personal data processing

Article 3 establishes important principles:

Lawfulness and fairness: Data must be processed legally and fairly.

Purpose limitation: Information must be collected for specified and legitimate purposes.

Data minimisation: Only information necessary for the intended purpose should be collected.

Accuracy: Inaccurate or incomplete information must be corrected or erased where appropriate.

Storage limitation: Personal data should not be retained longer than necessary.

These principles prevent organisations from collecting excessive personal information or using it for unrelated purposes.

BDJ+1

4. Individual rights under Moroccan personal data law

A. Right to information – Article 5

Before collecting personal information, an organisation must generally inform the individual about:

The identity of the data controller.

The purpose of collecting information.

The categories of information being collected.

The persons or organisations receiving the information.

Whether providing information is compulsory or optional.

The individual's rights of access and rectification.

For example, when a Moroccan bank collects identity documents to open an account, it should explain why the information is required and how it will be used.

B. Right of access – Article 7

Individuals have the right to obtain confirmation about whether their personal information is being processed.

They may request:

Information about the purposes of processing.

Categories of personal data held.

Details of recipients.

A readable copy of the information.

Available information about the source of the data.

Information about the logic underlying automated processing.

This right is particularly important where a person's identity is being used without their knowledge.

C. Right to rectification and erasure – Article 8

Article 8 provides the right to request:

Correction of inaccurate information.

Updating of outdated records.

Erasure of information processed unlawfully.

Blocking of information where appropriate.

Notification of corrections to third parties who received the information, where possible.

The controller must generally make the required correction without charge within ten days.

If the controller refuses or fails to respond within the statutory period, the individual can approach the CNDP.

Example: If a financial institution incorrectly records an individual's national identity number and that error affects the individual's credit profile, the individual can seek correction under Article 8.

D. Right to object – Article 9

An individual may object, on legitimate grounds, to the processing of personal data concerning them.

This right is relevant to:

Unwanted commercial profiling.

Unjustified disclosure of identity information.

Unlawful marketing.

Certain forms of behavioural monitoring.

Processing that unjustifiably interferes with personal rights.

E. Protection against automated decisions – Article 11

Article 11 restricts decisions producing legal effects against individuals when based solely on automated processing intended to evaluate aspects of their personality.

This is important in modern Morocco because organisations increasingly use automated systems for:

Credit assessment.

Recruitment.

Insurance decisions.

Customer profiling.

Risk evaluation.

Digital identity verification.

The provision recognises that important decisions affecting people should not be based exclusively on automated personality evaluation.

5. Consent and lawful processing

Article 4 establishes the general requirement for the individual's unequivocal consent to personal data processing.

However, consent is not the only lawful basis. The law also recognises certain exceptions, including:

Compliance with a legal obligation.

Performance of a contract or pre-contractual measures.

Protection of vital interests.

Performance of a public-interest task or exercise of public authority.

Legitimate interests, provided these do not override the individual's fundamental rights and freedoms.

Consent must therefore be distinguished from mere participation in a commercial or professional activity.

For instance, an employee providing a photograph for an internal employment record does not automatically authorise the employer to use that photograph in public advertising.

This distinction has become particularly important in Moroccan judicial decisions concerning image rights.

6. Protection of sensitive personal and biometric information

Article 1 of Law No. 09-08 identifies sensitive personal information, including information concerning:

Racial or ethnic origin.

Political opinions.

Religious or philosophical beliefs.

Trade union membership.

Health information.

Genetic information.

Article 3's general processing principles and the specific restrictions in Article 12 must be considered when handling these categories.

Biometric information also raises significant identity-protection concerns.

Examples include:

Facial recognition.

Fingerprint authentication.

Iris recognition.

Voice identification.

Biometric passport verification.

Biometric information can create serious risks because it relates to physical characteristics that cannot easily be replaced if compromised.

Processing sensitive information generally requires prior CNDP authorisation, subject to the exceptions and specific statutory arrangements.

7. CNDP: National data protection authority

Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) is Morocco's national authority responsible for supervising compliance with Law No. 09-08.

Its principal functions include:

Monitoring personal data processing.

Receiving and examining declarations.

Granting authorisations where required.

Investigating complaints.

Monitoring compliance with data protection requirements.

Advising public and private organisations.

Promoting awareness of privacy rights.

Supporting international cooperation.

CNDP notification and authorisation

Organisations generally have to make a prior declaration before processing personal data.

Certain higher-risk processing activities require prior authorisation, particularly processing involving sensitive information and other categories specified by law.

The CNDP's role is important because personal identity protection is not simply a matter of compensation after a violation. It also involves preventive regulatory supervision.

8. Confidentiality and security obligations – Article 23

Article 23 requires data controllers to implement appropriate technical and organisational measures to protect personal information.

These measures must address risks such as:

Accidental destruction.

Unlawful loss.

Unauthorised alteration.

Unauthorised disclosure.

Unauthorised access.

Other forms of unlawful processing.

Organisations using external service providers must also ensure that appropriate security obligations are imposed on their processors through legally binding arrangements.

Practical example: A Moroccan telecommunications company maintaining customer identity records should restrict employee access, protect databases, establish authentication controls and implement suitable security measures.

If identity documents are exposed through inadequate security, the organisation may face regulatory and civil liability depending on the circumstances.

9. International transfer of personal data – Articles 43–44

Modern organisations frequently transfer personal information between countries.

Examples include:

International cloud storage.

Foreign banking platforms.

Multinational employment databases.

International insurance services.

Global customer-management systems.

Article 43 establishes restrictions on transfers to countries that do not provide an adequate level of protection.

Article 44 recognises specified exceptions, including express consent and other legally permitted circumstances.

Therefore, a Moroccan organisation cannot assume that personal information may automatically be transferred to a foreign cloud provider merely because the organisation has a commercial agreement with that provider.

10. Civil liability for personal data and identity violations

Personal data misuse may give rise to civil liability under Morocco's general law of obligations and contracts.

The relevant legislation includes the Dahir of 12 August 1913 forming the Code of Obligations and Contracts.

A. Article 77 – Liability for wrongful acts

Article 77 provides a foundation for liability where a person, through an intentional or unintentional act, causes damage to another without legal justification.

It is relevant to situations involving:

Unlawful publication of personal photographs.

Misuse of identity documents.

Disclosure of private information.

Identity impersonation.

Unauthorised commercial exploitation of personal information.

B. Article 78 – Liability for negligence and lack of precaution

Article 78 concerns liability arising from negligence or lack of precaution causing damage.

For example, a company that negligently exposes customers' identity documents may face a claim if the required elements of civil liability are established.

C. Article 79 – Liability of public authorities

Article 79 concerns liability arising from the acts of public authorities and their agents in the performance of administrative functions, subject to its legal conditions.

It may be relevant where unlawful administrative handling of identity information causes legally recognisable damage.

D. Article 88 – Liability for things under one's custody

Article 88 may become relevant where damage is caused by a thing under a person's custody, subject to the statutory requirements.

Its application to technological infrastructure or data-related harm depends on the particular facts and legal characterisation.

E. Article 264 – Assessment of damages

Article 264 provides an important basis for determining contractual damages and has also been applied in the assessment of compensation in relevant civil disputes.

In personal identity cases, courts may consider:

Moral injury.

Reputational damage.

Financial losses.

Loss of professional opportunities.

Commercial exploitation of an individual's image.

The extent and duration of publication.

The claimant must establish the applicable elements of liability and the damage for which compensation is sought.

11. Important Moroccan case laws – At least 6 judicial decisions

The following decisions are particularly relevant to personal data protection, identity misuse, the right to one's image, privacy and civil liability.

Important legal distinction: Moroccan reported decisions specifically applying Law No. 09-08 remain relatively limited. Several of the following are decisions concerning the closely related civil-law right to one's image and personality rights. They should not all be described as direct judgments interpreting every provision of Law No. 09-08.

Case 1. Moroccan Supreme Court – 18 July 2007, Decision No. 813

Subject: Unauthorised commercial exploitation and unjust enrichment

The Supreme Court decision was cited by the Casablanca Commercial Court in a subsequent dispute concerning the commercial use of an individual's photograph and personal information.

Legal significance:

Commercial exploitation of another person's image without an appropriate legal basis can raise unjust enrichment issues.

A business cannot automatically acquire the right to commercially exploit someone's identity.

The absence of a contractual agreement may support a claim under the relevant provisions of the Code of Obligations and Contracts.

Relevant provisions: Articles 66 and 67 of the Moroccan Code of Obligations and Contracts.

Case 2. Moroccan Supreme Court – 28 June 2011, Decision No. 3127

Subject: Publication of a person's photograph without consent

This is an especially important Moroccan precedent concerning the right to one's image.

The Supreme Court recognised that the right to one's image is a personal right closely attached to the individual.

The judgment supports the principle that publishing another person's photograph without permission can constitute a wrongful act giving rise to compensation.

Legal significance:

The right to one's image is a personality right.

Publication without consent may constitute a civil wrong.

The individual may claim compensation for resulting damage.

Commercial or public use of a photograph requires appropriate authorisation.

This decision was expressly relied upon in the Casablanca Commercial Court judgment of 30 April 2024.

Case 3. Casablanca Commercial Court of Appeal – 17 June 2019, Decision No. 2856

Subject: Unauthorised use of an individual's image in an advertising video

The dispute concerned the commercial use of an individual's image in a promotional video without established consent.

The court considered the burden of proving authorisation.

It held that once publication of the disputed video was established, the party exploiting the image had to establish the existence of permission under the applicable evidentiary rules.

Legal significance:

The commercial use of an individual's image cannot be justified merely by the fact that the image is publicly accessible.

The person exploiting the image must establish the necessary authorisation.

Unauthorised commercial exploitation can create civil liability.

The claimant may seek compensation for the resulting injury.

Relevant legislation: Articles 399 and 400 of the Code of Obligations and Contracts, alongside the applicable copyright legislation.

Jurisprudence

Case 4. Casablanca Commercial Court of Appeal – 25 November 2019, Decision No. 5614

Subject: Unauthorised advertising use of a person's image and assessment of damages

This case concerned the exploitation of an individual's image for advertising purposes without consent.

The court considered:

Civil liability for unauthorised exploitation.

Material and moral damage.

Commercial loss.

The limitation period.

The date on which the victim became aware of the damage and the responsible party.

Legal significance:

The case demonstrates that unauthorised use of personal identity can generate compensable damage. It also highlights the importance of determining when the victim became aware of the wrongful conduct for limitation purposes.

Jurisprudence

Case 5. Casablanca Commercial Court of Appeal – 16 December 2021, Decision No. 6174

Subject: Publication of a photograph without consent and liability of a press publisher

The dispute concerned a female employee whose photograph was published by a press organisation without her consent.

The appellate court considered the publisher's civil liability and the extent of compensation for the infringement of image rights and privacy.

Legal significance:

Press organisations must respect individual personality rights.

Publication of photographs can interfere with personal privacy.

Unauthorised publication may justify civil compensation.

Material and moral damage must be considered in determining the appropriate remedy.

This case is particularly relevant to newspapers, digital publishers and online media platforms.

Jurisprudence

Case 6. Casablanca Commercial Court – 30 April 2024, Decision No. 5288

Subject: Unauthorised publication of a former employee's personal information

Highly relevant

This is one of the most directly relevant decisions for the present topic.

The dispute involved a former commercial adviser whose former employer allegedly published his photograph and personal information on social media for advertising purposes without his express authorisation.

The claimant also argued that the publication contributed to the loss of his subsequent employment.

The court considered:

Articles 66 and 67 of the Code of Obligations and Contracts.

Article 264 concerning damages.

The right to one's image.

Unjust enrichment.

The absence of express written consent.

Material and moral injury.

Decision and remedies:

The court awarded MAD 30,000 in damages and ordered removal of the photograph and personal information, subject to a penalty of MAD 500 for each day of delay in complying with the removal order.

The judgment relied on the Supreme Court's decision of 28 June 2011, No. 3127.

Legal significance: An employer's right to retain employment records does not automatically create a right to use a former employee's photograph and personal details for advertising.

Jurisprudence+1

Case 7. Casablanca Commercial Court of Appeal – 31 October 2024, Decision No. 5311

Subject: Commercial exploitation of a former employee's photograph and personal data

The dispute concerned the continued use of a former employee's image and personal information for commercial purposes after termination of employment.

The employer argued that the employee's participation in professional activities amounted to implied consent.

The court rejected the argument that ordinary participation in employment activities automatically authorised advertising use.

The court recognised that:

Administrative provision of personal information is different from consent to advertising use.

Commercial publication requires specific authorisation.

Unauthorised use can infringe the employee's image rights.

The resulting damage may include harm to professional opportunities.

The appellate court increased the compensation because the first-instance award did not adequately reflect the damage, including the alleged loss of professional opportunity supported by the case.

It maintained the principle that the disputed content had to be removed.

Legal significance: Consent for employment administration cannot automatically be extended to post-employment advertising.

Jurisprudence+1

Case 8. Casablanca Commercial Court of Appeal – 25 November 2025

Subject: Participation in a filmed event does not constitute consent to advertising publication

The court examined the commercial use of a consultant's image following his participation in a filmed event.

The company argued that the individual's participation and remuneration established consent to the publication.

The court rejected the argument that participation in an event, wearing branded clothing or receiving payment automatically amounted to permission for subsequent advertising publication.

It upheld the finding of civil liability and the removal of the disputed content.

The court also declined to increase the compensation because the additional commercial damage claimed had not been sufficiently established.

Legal significance:

Consent must relate to the particular use of the image.

Participation in filming is not necessarily consent to unrestricted publication.

Advertising use requires express and unequivocal authorisation.

Compensation depends on proof and judicial assessment of the damage.

Jurisprudence

Case-law summary

These decisions illustrate how Moroccan courts use personality rights and general civil liability principles to protect individuals against unauthorised exploitation of their identity.

12. Criminal sanctions under Law No. 09-08

Moroccan law does not rely exclusively on civil compensation. Chapter VII of Law No. 09-08 provides criminal and financial penalties.

These sanctions are without prejudice to applicable civil liability. Article 61 also allows the court to order seizure of equipment used in the offence and erasure of the relevant data.

BDJ+1

13. Identity theft and digital impersonation in Morocco

Identity theft occurs when someone uses another person's identifying information without permission or lawful authority.

Examples include:

Using another person's national identity card.

Opening a bank account using stolen documents.

Creating fraudulent social media profiles.

Using another person's photograph to deceive customers.

Impersonating someone through email or messaging applications.

Obtaining loans using another person's identity.

Misusing biometric authentication information.

Accessing digital accounts through stolen credentials.

Law No. 09-08 protects the underlying personal information. However, identity theft may also involve offences under other Moroccan legislation, including applicable provisions of the Penal Code and cybercrime legislation.

Where private communications or confidential information are intercepted or distributed unlawfully, Article 447 and related provisions of the Penal Code may also become relevant, depending on the conduct.

It is important to distinguish between unlawful personal data processing and identity theft: the same incident may involve both, but they are not legally identical.

:+1

14. Application in important civil-law sectors

A. Banking and financial institutions

Banks collect extensive personal information, including identity documents, addresses, signatures, financial records and transaction histories.

Legal obligations include:

Protecting customer identity information.

Restricting unauthorised employee access.

Preventing fraudulent disclosure.

Maintaining appropriate security arrangements.

Correcting inaccurate customer records.

Complying with lawful processing requirements.

Identity theft involving banking records may result in civil liability and criminal proceedings.

B. Employment and labour relationships

Employers process information concerning employees, including photographs, identity documents, salary details and employment records.

The employer's authority to maintain employment records does not mean that it can use those records for every commercial purpose.

The Casablanca decisions of 2024 demonstrate the importance of obtaining specific authorisation before using former employees' photographs and information for promotional purposes.

C. Healthcare institutions

Hospitals, clinics and medical professionals process sensitive health information.

Such institutions must protect medical records, diagnostic information and patient identities.

Unauthorised disclosure may violate Law No. 09-08, professional confidentiality obligations and other applicable legislation.

D. Telecommunications and social media

Telecommunications companies and digital platforms process information such as:

Telephone numbers.

Subscriber identities.

Communication-related records.

Photographs and videos.

Account information.

Digital identifiers.

They must comply with applicable privacy and security requirements.

E. Public administration and civil registration

Government institutions maintain information concerning birth registration, nationality, passports, family status and national identification.

Incorrect or unauthorised modification of such records may affect a person's legal identity, access to public services and civil status.

The protection of these databases is therefore essential to the integrity of the Moroccan civil registration system.

15. Legal remedies available to victims

An individual whose identity or personal information has been misused may consider several remedies.

A victim should preserve evidence such as screenshots, messages, publication dates, correspondence, identity documents and records of financial losses.

A practical approach is to request removal or correction from the responsible organisation, exercise the applicable rights under Law No. 09-08 and approach the CNDP where necessary. Civil or criminal proceedings may also be appropriate depending on the facts.

16. Challenges in Morocco's personal data identity protection framework

Despite the existence of Law No. 09-08, several challenges remain.

1. Digital identity theft

Fraudsters increasingly exploit stolen identity documents, photographs and account credentials.

2. Biometric security

Facial recognition and fingerprint databases create risks because compromised biometric information is difficult to replace.

3. Artificial intelligence

AI systems can process large quantities of personal information and generate identity profiles, creating risks of inaccurate identification and unlawful profiling.

4. Social media misuse

Personal photographs and information may be redistributed without the individual's permission.

5. Cross-border data transfers

International cloud services and multinational platforms create difficulties concerning data protection and regulatory supervision.

6. Weak organisational awareness

Some organisations may not fully understand their obligations concerning consent, data minimisation, security and CNDP formalities.

7. Limited published judicial decisions

The number of publicly accessible Moroccan decisions directly addressing Law No. 09-08 is relatively limited. This makes the development of consistent judicial interpretation an important issue.

17. Future development of personal identity protection law in Morocco

Several developments could strengthen Morocco's civil-law framework.

Stronger protection of biometric and digital identity information.

Improved security standards for government databases.

Better regulation of AI-based identification systems.

Clearer procedures for identity theft victims.

More effective enforcement of data subject rights.

Improved cross-border privacy cooperation.

Greater accountability for digital platforms.

Better coordination between the CNDP, courts and other regulatory authorities.

The legal framework should also ensure that technological innovation does not undermine constitutional privacy rights or individual dignity.

18. Conclusion

Personal Data and Identity Protection Law in Morocco represents an important development in modern civil law. Law No. 09-08, together with the Moroccan Constitution, the Code of Obligations and Contracts and applicable criminal legislation, provides a framework for protecting individuals against unlawful collection, processing, disclosure and exploitation of personal information.

The Moroccan Supreme Court and Casablanca commercial courts have also developed important principles concerning image rights, consent, commercial exploitation and compensation.

The decisions of 30 April 2024 and 31 October 2024 are particularly significant because they demonstrate that an employer's possession of an employee's personal information does not automatically confer permission to use it for advertising.

Ultimately, personal identity protection in Morocco involves three interconnected legal objectives:

Privacy protection: Preventing unlawful interference with personal information.

Identity protection: Preventing unauthorised use and commercial exploitation of personal identity.

Civil accountability: Providing compensation and appropriate remedies when legally protected rights are violated.

The effectiveness of this framework will increasingly depend on how Moroccan courts and the CNDP address emerging challenges involving artificial intelligence, biometrics, digital identification and international data processing.

Research note: This is a legal research overview, not a substitute for checking the full text of judgments and legislation. The case references above distinguish reported judicial decisions from earlier Supreme Court precedents cited by subsequent courts. Some decisions are unpublished, and the image-rights judgments should not be mistaken for eight separate Supreme Court rulings on Law No. 09-08.