Morocco passenger data record

Law 09-08 and the CNDP

Law No. 09-08 covers the protection of natural persons in the processing of personal data ¹. It was promulgated by Dahir No. 1-09-15 of 18 February 2009 and published in Bulletin officiel No. 5714 on 5 March 2009 ¹. The CNDP publishes the text on its website ².

Article 27 sets up the CNDP, the Commission nationale de contrôle de la protection des données à caractère personnel, attached to the Prime Minister ¹. The CNDP runs a national register of processing and an online complaint form ³.

Article 1 defines sensitive data as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or union membership, and health data including genetic data ¹. The law does not name biometric data ¹. Article 12 requires prior authorisation for genetic data and for data that contains a national identity card number ¹.

Security exemptions and transfers abroad

• Article 2 excludes data collected and processed for national defence or the internal or external security of the State ¹.
• For crime prevention and prosecution, the law applies only under the terms of the law or regulation that creates the file. That text must name the controller, purposes and security measures, and needs the prior opinion of the CNDP ¹.
• Article 43 allows transfers to a foreign state only if it gives a sufficient level of protection. The CNDP keeps the list of qualifying states ¹.
• Article 44 allows transfers to other states in set cases, including express consent, a bilateral or multilateral agreement, or a reasoned authorisation from the CNDP ¹.

The DGSN passenger information centre

Article 212 of Law No. 40.13 on the civil aviation code requires air carriers to send API and PNR data to public authorities for domestic and international commercial flights, as reported by Hespress FR (no individual byline) on 7 July 2022 ⁴. On that day the Government Council adopted draft decree No. 2.21.624 to apply Article 212 ⁴. Interior Minister Abdelouafi Laftit presented the text ⁴.

The draft decree creates a national centre for processing air passenger and flight information, placed under the authority of the Director General of National Security ^4,5. The centre sets up and manages an IT system to process, analyse, exchange and keep the data airlines send, and sets the technical terms of access ^4,5. Le360 reported that Morocco had begun to carry out the project and that the centre was coming soon ⁵.

Neither report gives a retention period, a start date or the role of the CNDP ^4,5. This page did not find the decree in the Bulletin officiel, so its final text and publication date are not confirmed here ⁴.

ICAO status listing

On 18 July 2024 the ICAO AFI SECFAL Plan Secretariat listed Morocco among 19 African states developing a legal basis for API or expecting to do so soon ⁶. Morocco was not listed among states with API or PNR in force, or among the 10 states developing a PNR legal basis ⁶. The ICAO listing and the 2022 draft decree on PNR data give different pictures, and this page shows both with their dates ^4,6.

Airport gates and biometrics

As reported by Samir El Ouardighi in Médias24 on 8 February 2019, the airports office ONDA planned gates at Casablanca Mohammed V airport that would first read boarding passes, not passports ⁷. The report said a later phase, planned for 2020 or 2021, would check passports and holders by fingerprint or facial recognition, for adults with biometric passports ⁷. It said no tender had yet been launched for that phase and named no supplier ⁷.

This page found no official DGSN record confirming biometric capture of travellers at entry ^6,7.

E-visa, suppliers and official findings

The e-visa portal at acces-maroc.ma describes itself as the foreign affairs ministry portal for visa and eVisa requests ⁸. The form asks for nationality, country of residence, passport type, travel purpose and any other valid visa before an eligibility check ⁸. The page this site opened did not show fees or a privacy notice ⁸.

This page found no official record or named-reporter report naming a supplier for the DGSN passenger information centre, the e-visa portal or border biometrics ^{4,7 8}. It found no CNDP decision, audit or court finding on these systems ³.