Interview with Mr. Omar Seghrouchni, president of the CNDP of MOROCCO

Mr. Omar Seghrouchni

We would like to thank Mr. Omar Seghrouchni, President of the National Commission for the Protection of Personal Data in Morocco (CNDP), for accepting our invitation to come and talk about the protection of personal Data.

1-The protection of personal data has become, with the digital transformation, a topical subject in Morocco. Indeed, it allows companies, on the one hand, to build trust with their partners and, on the other hand, it is a means of enabling users to protect their privacy. Several actions have been undertaken since 2010 by the CNDP (the National Commission for the Protection of Personal Data). Can you give us a summary of the CNDP results?

Omar Seghrouchni: The period from 2010 to 2018 was a period of putting in place the foundations. It was essential. The CNDP started from nothing… No headquarters, no collaborators, no procedures… So, this period was a period of construction… In addition, the CNDP has left its footprints on the regional level, in Africa, and at the international level. It took its place among its peers, which was a major move. Nationally, the CNDP, during this period, worked with a number of sectors (Banks, Insurance, etc.) to clarify and facilitate compliance procedures. The Commission has organized awareness-raising and training sessions on behalf of several sectors of activity in different cities. Complaints management mechanisms have been put in place, too. We are now moving up a gear.

2- Isn’t it useful for the CNDP to get help from accredited entities in order to facilitate its work at the national level. These entities can play an important role in the preparation of files to be submitted to the CNDP and also in assisting on the understanding of some sections of Law 08-09. For example, I read Law 08-09 but had difficulty understanding section 11 concerning the neutrality of effects?

Omar Seghrouchni: The issue of accredited entities is a subject that comes up often and to which we reflect. The system would have to be robust to achieve the right goals. We should initiate discussions with interested organizations. Section 11 that you cite is very important … It governs the use of calculations underlying automatic decisions. You may be hitting one of the major actions in terms of awareness that we are preparing. We must be able to protect citizens in the current context, in particular that of big data and artificial intelligence. Often for reasons of economic efficiency or otherwise, the privacy of individuals can be negatively impacted. You have to be able to do a risk analysis and identify the right compromises.

3- Against the multiplication of surveillance cameras installation without prior declaration or authorization, should we not consider upstream actions to fight against these facts? For example, by making the sellers responsible or by facilitating the granting of authorization to users and consumers of these cameras with a very simple online declaration.

Omar Seghrouchni: The Commission has published a deliberation dedicated to video surveillance cameras (deliberation 350-2013). We have observed, after several years of practice, that more precision is needed in the declarations made in order to be in a better position of control, and therefore of protection.
In addition, it is important to dematerialize the notification process, not just those concerning video surveillance.

4-How will the CNDP be able to support Moroccan companies concerned by the European RGDP?

Omar Seghrouchni: The GDPR is a European regulation … The CNDP has no direct role on the subject formally. However, we take this situation very seriously, and we are working to provide support, on two different levels:
• First of all, we explain, whenever we can, to Moroccan actors, the principles and logic of the GDPR. And as soon as the evangelization takes place, we will invite European experts and some of our counterparts within the European authorities to come and advise and explain live the ins and outs.
• In addition, we are working within the framework of revising the law, in order to align our legal system with international standards, including the GDPR, and ultimately avoid putting Moroccan actors in a situation of “dispersion” in the face of different regulations.
5- in a second step will the draft amendments to law 08-09 consider this RGDP? Knowing that law 08-09 is limited to Moroccan territory.
Omar Seghrouchni: We must not think only in terms of treatment territory, but also in terms of collection territory:
• When data is collected in Europe, the GDPR applies regardless of the processing territory. If this is subcontracted to Morocco, Law 09-08 will apply in addition to the GDPR.
• When data is collected in Morocco, Law 09-08 applies regardless of the processing territory. If the latter is outside Morocco, a transfer notification must be processed by the CNDP.
Once we understand this, we can better define the operational interactions to comply with both regulations.

6-In the context of the advent of technologies such as artificial intelligence, the protection of personal data is becoming a real global challenge. Should we not consider, in addition to national organizations, a protector of personal data on a global scale? Can a specialized UN agency, for example, play a role in this regard?

Omar Seghrouchni: Personally, I think having international arbitration and protection mechanisms is a must. But we have to look at what level should it be placed. The United Nations would be an interesting place. However, we should not be faced with gas factories. We must be able to remain pragmatic, efficient and operational. Today, one of the binding and multilateral frameworks, to which Morocco has adhered, is Convention 108. This framework is supported by the Council of Europe and is open to non-European countries. This can be a first test space.

(*): Mr. Omar SEGHROUCHNI was appointed, on November 17, 2018, President of the National Commission for the Protection of Personal Data (CNDP) in Morocco. He graduated from the engineering School of Mohammedia (Rabat, Morocco). He earned a postgraduate degree in Mathematics and Automation from the University of Paris IX – Dauphine and from Mines de Paris school. He also holds a master degree in Diplomacy and Strategy from CEDS in Paris and a master’s degree in Economic Intelligence from the Ecole de Guerre Economique in Paris. He began his career in 1988, in France, in the world of research. Mr. Omar SEGHROUCHNI has led several major transformation projects in both the private and public sectors, in Morocco and in Europe. He developed the concept of “governance of transformations”.