Loi 09-08 art. 11 — neutrality of the effects of automated processing: bar on decisions grounded solely in automated profiling
Binds Controllers within the scope of art. 2: processing of personal data wholly or partly by automated means, and non-automated processing of personal data contained in or intended to form part of manual files, where the controller is established on Moroccan territory and carries on an activity there, or is not established in Morocco but resorts, for the purposes of processing personal data, to automated or non-automated means situated on Moroccan territory. A controller in the second case must designate a representative established in Morocco who is substituted for it in the rights and obligations arising under the Law. Prior declaration to, or prior authorisation from, the Commission Nationale de contrôle de la protection des Données à caractère Personnel is a standing precondition of processing under arts. 12 and 13, with art. 12 requiring prior authorisation for sensitive-data and other listed processing. The art. 11 bar binds any controller taking a decision with legal effects grounded solely in automated profiling or personality evaluation, irrespective of size, and its first paragraph binds courts. Impact tier: all entities.. Article 11 of Law No. 09-08 relating to the protection of individuals with regard to the processing of personal data, headed “Neutralité des effets d'un traitement automatisé”, carries Morocco's operative automated-decision rule. Its first paragraph provides that no judicial decision involving an appraisal of a person's conduct may be founded on automated processing of personal data intended to evaluate certain aspects of that person's personality. Its second paragraph extends the bar beyond the courts: no other decision producing legal effects in respect of a person may be taken on the sole basis of automated processing of data intended to define the profile of the person concerned or to evaluate certain aspects of their personality. Its third paragraph sets the carve-out: decisions taken in the course of the conclusion or the performance of a contract, and for which the data subject has been put in a position to make observations, are not regarded as taken on the sole basis of automated processing, and neither are decisions granting a request made by the data subject. Article 7(c) supplies the companion transparency right, entitling the data subject to knowledge of the logic underlying any automated processing of personal data concerning them, alongside the confirmation and communication rights in art. 7(a) and (b). Article 11 is a transposition of art. 15 of Directive 95/46/EC by way of the French model, drafted in 2009 and so predating the GDPR: it speaks of automated processing intended to profile or to evaluate personality rather than of “profiling” as a defined term, and the safeguard it names is an opportunity to make observations rather than human intervention.
Law 09-08 was promulgated by Dahir nº 1-09-15 of 22 safar 1430 (18 February 2009) and published, together with the dahir, in Bulletin Officiel nº 5714 of 7 rabii I 1430 (5 March 2009), the date recorded here. The Law contains no commencement clause and no deferred-commencement mechanism: it ends at art. 67 and the dahir simply orders publication in the Bulletin Officiel. The date is confirmed directly against the Secrétariat Général du Gouvernement's own Bulletin Officiel sommaire index, which records Dahir nº 1-09-15 as “Publié le 05.03.2009” in B.O. nº 5714, and no longer rests only on the header of the CNDP copy. What is still unverified is the general Moroccan rule tying entry into force to that publication: it predates the SGG sommaire index and returns nothing on it, so it has not been read against a primary source, and that single gap is why confidence stays medium rather than high. Nothing turns on more than a few days either way — Décret nº 2-09-165 of 25 joumada I 1430 (21 May 2009), taken for the application of the Law, was itself published in B.O. nº 5744 on 18 June 2009, so the Law was operative that year on any reading. Article 67 is transitional only: it gave persons already carrying on processing before publication a maximum of two years, running from the date of the CNDP's installation as recorded by an administrative act published in the Bulletin Officiel, to regularise their declarations and authorisations, and on its own terms it reaches the declaration and authorisation regime rather than the art. 11 bar. Décret nº 2-09-165 was taken for the application of the Law; the CNDP publishes it only in Arabic, but the SGG sommaire supplies its French particulars, cited above. Coverage symmetry against the four African rows already tracked: Morocco is the oldest drafting of the five and the only one in the Directive 95/46/EC lineage rather than the GDPR art. 22 or UK DPA 1998 s. 12 lineages. Structurally it is closest to za-popia-s71 — both are prohibitions whose contract exception is conditioned on the data subject having had an opportunity to make representations, and neither grants human intervention or a fresh decision — but Morocco is narrower in two ways and wider in one. It is narrower in that its bar reaches only decisions producing legal effects, with no “substantial degree” or “significant effect” limb as in South Africa, Kenya, Nigeria, Rwanda, Tanzania and Ghana, and in that its disclosure duty sits in art. 7(c) as an access right rather than inside the automated-decision article as in za-popia-s71(3). It is wider in that its first paragraph binds courts directly, which no other row on the tracker does. It carries no deadline. Text read in the copy of the Law published by the CNDP, the supervisory authority instituted by the Law. Supersession checked 23 August 2026 against the SGG Bulletin Officiel sommaire search, the official gazette index, and cleared: an exact-expression search for “09-08” anywhere in a sommaire returns eight texts across the whole series, of which only two concern this Law — the promulgating Dahir nº 1-09-15 (B.O. 5714) and the application Décret nº 2-09-165 (B.O. 5744) — with no “modifiant et complétant la loi nº 09-08” entry anywhere; and a search restricted to texts of the nature “Loi” for the exact expression “données à caractère personnel” returns exactly one result in the entire series, Loi 09-08 itself, so no successor statute has replaced it either. The index was current to B.O. nº 7536 bis of 21 August 2026 when this was run. This was the Coverage Symmetry follow-up opened by the Algeria correction of 23 August 2026, where art. 11 of Loi 18-07 was repealed outright and its rule relocated into a law-enforcement-only title: Morocco does not share that defect. Art. 11's second paragraph is on its face addressed to “aucune autre décision” beyond the judicial decisions of the first paragraph, so it binds ordinary controllers, and the roles and topics carried here are the same ones the thirteen other African rows in this lineage carry.
Stated maximum penalty — Article 11 has no dedicated penalty: the criminal tier in Chapter VII attaches to named articles and art. 11 is not among them. Article 53 punishes a controller that refuses the access, rectification or objection rights under arts. 7, 8 and 9 with a fine of MAD 20,000 to MAD 200,000 per infringement, which reaches the art. 7(c) right to know the logic underlying automated processing but not the art. 11 bar itself. The nearest general route is art. 63, under which a controller that refuses to apply the decisions of the Commission Nationale is liable to imprisonment of three months to one year and a fine of MAD 10,000 to MAD 100,000, or one of those penalties only; art. 62 punishes obstruction of the Commission's supervisory functions with imprisonment of three to six months and a fine of MAD 10,000 to MAD 50,000, or one of them. Article 64 doubles the fines where the offender is a legal person, without prejudice to penalties on its officers, and allows partial confiscation of assets, confiscation under art. 89 of the Penal Code, and closure of the establishment where the offence was committed; art. 65 doubles the sanctions on repeat offence within a year of a final conviction. Article 66 lets sworn agents of the Commission, alongside judicial police officers, investigate and record infringements by procès-verbal for transmission to the Crown Prosecutor within five days.