Data Protection and Competition Regulations in Morocco

The intersection between data protection and competition law in Morocco represents a complex and evolving area of legal practice. As businesses and markets become increasingly dependent on the collection, processing, and commercialization of personal data, understanding the regulatory framework governing these practices is essential. The legal regimes governing data protection and competition law in Morocco are designed to safeguard both consumer privacy and the integrity of market competition. However, the relationship between these two areas of law is multifaceted, often presenting challenges for regulators, businesses, and consumers alike. In this context, it is crucial to examine both the foundational legal principles of data protection in Morocco and the mechanisms of competition law, while considering how these two regimes intersect and influence one another.

Moroccan data protection law

At the core of Morocco’s approach to data protection is Law No. 09-08, which governs the protection of personal data. This law, enacted to ensure the privacy of individuals and the proper handling of their personal information, aligns with international data protection standards. It mandates that the processing of personal data must comply with the principles of fairness, lawfulness, and transparency. The Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) is the regulatory authority responsible for ensuring compliance with these provisions. Under Law No. 09-08, personal data may only be collected for specified, legitimate purposes and must not be further processed in a manner incompatible with those purposes. Consent is the primary basis for data processing, although exceptions exist for processing necessary for the performance of a contract, legal obligations, or public health concerns. Furthermore, individuals are granted various data subject rights, including the right to access, rectify, and erase their data, as well as the right to object to its processing.

Moroccan competition law

While Law No. 09-08 provides the primary legal framework for personal data protection, the regulation of competition in Morocco is governed by Law No. 40-21 and Law No. 104-12. These statutes prohibit anti-competitive practices such as cartels, abuses of dominant position, and mergers or acquisitions that would substantially lessen competition in the market. The Competition Council is the body responsible for enforcing the Kingdom’s competition law and ensuring that business practices do not distort market dynamics. The provisions of these laws are designed to prevent firms from engaging in behavior that harms consumer welfare, market efficiency, or free competition. Specifically, Law No. 40-21 prohibits horizontal agreements and vertical restraints that restrict competition, while Law No. 104-12 ensures that dominant firms cannot misuse their position to stifle competition or engage in unilateral conduct that may harm market dynamics. The Competition Council has the authority to assess and sanction such practices, aiming to restore a level playing field in the market. 

Intersection of the data protection and competition regimes

The intersection of data protection and competition law arises when the use of personal data becomes a tool for market control or manipulation. For example, the acquisition of personal data through mergers or acquisitions can raise significant concerns regarding competition. Large-scale access to consumer data can create barriers to entry for smaller competitors, granting established firms a dominant position in the market. Such acquisitions may thus have the potential to distort competition by limiting the ability of new entrants to compete on an equal footing. Hence, the Competition Council may consider the impact of data on market power and whether its use or acquisition could substantially lessen competition.

Additionally, the relationship between data protection and competition law becomes evident in the context of price regulation. Under Decree No. 2-14-652, which governs the regulation of prices in Morocco, the Competition Council consults on matters relating to goods, services, and products whose prices are subject to regulatory oversight. Though not directly related to data protection, this consultation process may involve data-driven market analysis, particularly as digital services increasingly rely on large volumes of consumer data to determine pricing strategies. The influence of such data on pricing practices further exemplifies the intersection between data protection law and competition law, where the improper handling or use of data could distort market efficiency.

Cooperation between regulatory authorities

The cooperation between the Competition Council and the CNDP is vital to ensure the coherent application of both competition law and data protection regulations. A notable development in this regard is the cooperation agreement signed on 13 November 2018, between these two bodies. This agreement enables the exchange of information, facilitates consultation, and supports joint awareness-raising initiatives. Through this partnership, the Competition Council and the CNDP aim to strike a balance between fostering a competitive market and protecting individuals' privacy and personal data.

The evolving digital economy, marked by increasing reliance on personal data for business

operations, requires regulatory oversight that spans both competition law and data protection. This collaboration is of increasing important as the economic value of personal data continues to rise, raising questions about its role in influencing market behavior.

The intersection of data protection and competition law reflects broader trends in the digital economy, where the exploitation of personal data by large companies can influence competitive dynamics. The data subject’s rights, such as the right to rectification or the right to object to data processing, can impact market competition, especially in sectors where data-driven services are crucial to consumer choice.  In this sense, businesses must navigate not only the potential for anti-competitive conduct but also ensure that their data processing practices comply with privacy regulations. The principle of accountability embedded in both data protection and competition law places an emphasis on companies’ responsibility to adhere to legal standards, ensuring that data is processed transparently and ethically, while also preventing market abuses.

In conclusion, the legal relationship between data protection law and competition law in Morocco is dynamic and critical to ensuring that businesses operate fairly and transparently in the marketplace. Both legal regimes—data protection and competition—serve complementary purposes: protecting consumer rights and ensuring that businesses act in a manner that promotes market competition. As personal data continues to play an increasingly central role in modern business operations, the need for a balanced regulatory approach will only grow.