Law No. 09-08, the CNDP and sanctions

Article 27 establishes the CNDP under the Prime Minister to implement and enforce the law, advise the government and parliament on processing-related bills and regulations, and receive declarations, representative notifications and complaints.

Article 28 gives it power to authorize extended retention and response delays, order corrections, issue the Article 12 and Article 21 authorizations, set the adequate-states list, authorize transfers, run the national register, grant security-measure exemptions, escalate a declared processing to authorization, and withdraw a receipt or authorization.

Articles 30-31 give the CNDP's commissioned agents investigative and enforcement powers, including access to processing sites and data and the power to order blocking, erasure, destruction or a halt to processing, exercised under a disciplinary procedure that guarantees the rights of the defense.

Articles 32-42 set the CNDP's composition (a president and six members, all royally appointed, serving five-year terms renewable once), its meeting and voting rules, member incompatibilities and recusal duties, professional secrecy for its members and staff, and its secretariat and committee structure. Article 51 lets the CNDP withdraw a declaration receipt or an authorization, without delay, where the processing it covers threatens public security or order or offends morality.

Articles 52-63 set a graduated penalty ladder: undeclared or unauthorized processing draws a fine of 10,000 to 100,000 dirhams only (Article 52); refusing an access, rectification or objection request draws a fine of 20,000 to 200,000 dirhams per infraction (Article 53); unlawful collection, off-purpose processing, over-retention, processing without the required consent, inadequate security measures, disregarding a legitimate or marketing objection, and an unlawful cross-border transfer each draw imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams (Articles 54-56, 58-60); processing sensitive data or offense and conviction data without the required consent or authorization draws imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the statute's highest tier (Article 57); obstructing CNDP control draws imprisonment of three to six months and a fine of 10,000 to 50,000 dirhams (Article 62); and refusing to comply with a CNDP decision draws imprisonment of three months to one year and a fine of 10,000 to 100,000 dirhams (Article 63).

Article 52 states these criminal sanctions without prejudice to the civil liability of anyone whose fault causes damage, preserving a data subject's ordinary civil claim for compensation. Article 64 doubles fines for a legal person and adds asset confiscation or closure of the establishment as available sanctions, and Article 65 doubles all sanctions on recidivism within a year of a final conviction.

Article 66 lets specially commissioned and sworn CNDP agents, alongside judicial police officers, investigate and record offenses by official report, forwarded to the public prosecutor within five days.