Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 78
Country Source Text or translation (excerpts; notes are given in italics)
Morocco Law No. 09-08
Relative to the
Protection of
Individuals with
regards to their
Personal Data (5
March 2009)
Chapter 5, Article 43 - the transfer of data to a foreign country
The data controller shall not transfer any personal data to a foreign
country unless that country ensures a sufficient level of protection for
privacy rights and freedoms.
The level of protection provided by the foreign country shall be assessed
in light of the regulations and security measures applicable in that
country, the characteristics of the processing such as the purpose,
duration, nature, origin and intended destination of personal data.
The DPA has established a list of countries that comply with the
provisions mentioned above.
Article 44
As an exception to the provisions of Article 43 above, the data controller
may transfer personal data to a foreign country that does not fulfill the
requirements mentioned if the data subject gave its express consent for
such a transfer or:
1. if the transfer is justified by one of the following conditions:
a) for the protection of the data subject’s life;
b) in the public’s interest;
c) for reasons of contractual obligations between the data controller and
the data subject;
d) at the conclusion or execution of a contract in the interest of the data
subject by the data controller and a third party;
e) at the conclusion or execution of a contract or a contract to be
concluded, in the interest of the data subject, between the data controller
and a third party;
f) at the execution of an international mutual assistance agreement on
judicial matters;
g) for the prevention, diagnosis and treatment of medical diseases.
2. If the transfer is made in compliance with a bilateral or multilateral
agreement to which Morocco is a party.
3. At the express authority of the DPA, when the processing ensures a
sufficient level of protection for privacy rights, rights and freedoms of
data subjects, such as through standard contractual clauses or binding
corporate rules.