Morocco

Article 2 applies the law to automated and manual processing of personal data by a physical or legal person, public or private, whose controller is established in Morocco or who uses processing means located there. Article 4 requires the data subject's unambiguous consent before processing, unless the processing falls under Article 4's enumerated exceptions (a legal obligation, contract performance, vital interest, a public-interest mission, or the controller's legitimate interest).

Article 12 requires most processing to be the subject of a prior declaration to the CNDP, and requires CNDP prior authorization for sensitive data (Article 1(3): racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data including genetic data), which is otherwise prohibited absent the data subject's express consent or another Article 21 ground.

Articles 7 to 9 give the data subject the right to access, rectify, and object to the processing of their data, and a provision preceding Article 7 bars a decision producing legal effects on a person from being based solely on automated processing intended to profile or evaluate an aspect of their personality. Article 10 bars direct marketing by automated call, fax, or electronic mail to a person who has not given prior consent.

Article 43 bars transferring personal data to a foreign state unless that state ensures a sufficient level of protection, as assessed by the CNDP, which maintains a list of adequate states. The CNDP, established by Article 27, supervises compliance, receives declarations and complaints, and issues authorizations.

Breach of these duties is backed by a graduated schedule of fines and, for several offences, imprisonment: an unauthorized or undeclared processing draws a fine of 10,000 to 100,000 dirhams (Article 52); refusing an access, rectification, or objection request draws a fine of 20,000 to 200,000 dirhams per infraction (Article 53); fraudulent or unlawful collection, or processing beyond the declared purpose, draws imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams (Article 54); an unlawful cross-border transfer draws the same imprisonment and fine range (Article 60); and processing sensitive data without the data subject's express consent draws imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the highest tier in the statute (Article 57).

Article 5(b) protects a compilation, encyclopedia, anthology or database as a copyrightable work where the selection, coordination or arrangement of its contents constitutes an original intellectual creation, whether recorded on a machine-readable medium or otherwise, rather than through a separate sui generis database right.

Article 12 permits free reproduction of a lawfully published work for the user's exclusively private use, but its second paragraph, at 12(c), expressly withholds that exception from the reproduction of the whole or part of a database in digital form, so a digital-form database stays within the author's exclusive right regardless of the reproducer's private purpose.

A wilful, commercially-motivated infringement of these rights is punished under Article 64 (as amended) by imprisonment and a fine, doubled for a repeated infringement and further increased for a new infringement within five years of a final judgment, and Article 62 lets the rights holder choose between actual damages plus the infringer's profits or pre-established damages of 5,000 to 25,000 dirhams.

Article 70 states that the Law's provisions enter into force six months after publication in the Bulletin Officiel, which the same source dates to 6 July 2000, placing the commencement date six months later.

Article 14 lets any person quote a lawfully published work in another work without the author's authorization, on condition of citing the source and the author's name where it appears in the source, and provided the quotation conforms to fair practice and its extent does not exceed what its purpose justifies.

Article 19(a) separately lets the press reproduce, broadcast, or communicate to the public an economic, political, or religious article published in a newspaper or periodical, or a broadcast work of the same character, on the same source-and-author-name condition, unless the right to reproduce, broadcast, or communicate it has been expressly reserved.

Article 70 states that the Law's provisions enter into force six months after publication in the Bulletin Officiel, which the same source dates to 6 July 2000, placing the commencement date six months later.