Video surveillance and Law 09-08: key points before deploying video analytics

Why video analytics is affected

As soon as a camera films identifiable people, the footage is personal data. In Morocco, its processing is governed by Law No. 09-08 on the protection of individuals with regard to the processing of personal data, supervised by the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel).

Adding artificial intelligence to cameras does not change that, but it does change the nature of the processing: you are no longer just recording, you are analysing. That is why a video analytics project needs to be prepared from a legal as well as a technical standpoint.

Disclaimer: this article sets out general points of attention. It is not legal advice and is no substitute for having your situation reviewed by a lawyer, or for consulting the texts and guidance published by the CNDP.

Define the purpose and the roles

It all starts with a simple question: what is the system for? Protecting property, measuring footfall, managing queues, safety in a work area… Each purpose must be specified, explicit and legitimate. The footage must not later be reused for an incompatible purpose.

Roles also need clarifying. The business that installs the cameras and decides how they are used is the data controller. The solution provider or integrator may act on its behalf: its role and obligations, particularly regarding security and confidentiality, should be set out in the contract.

That contract deserves close attention: who has access to footage and results, where data is processed and stored, what security measures are in place, and what happens to the data when the service ends? Clear written answers to these questions also make your dealings with the CNDP easier.

Formalities with the CNDP

Law No. 09-08 requires prior formalities before processing begins: depending on the case, a declaration or an application for authorisation. The CNDP has published guidance and forms dedicated to video surveillance, which should be consulted on its official website.

In practice, before deploying video analytics, ask yourself the following questions:

• has the existing CCTV system gone through a formality, and for which purposes?
• does adding analytics (counting, queues, durations) amount to a new purpose that needs to be declared or authorised?
• is any data transferred outside Morocco, for example to a cloud service, which may call for specific formalities?
• who in the business is responsible for following up these steps and keeping the supporting documents?

Inform the people being filmed

Customers, visitors and employees must know that they may be filmed. The most common way to do this is visible signage placed before entering the covered area. It usually states that the system exists, who is responsible for it and how to exercise the rights of access, correction and objection.

Where analytics is carried out, it is good practice to mention its nature, for example footfall measurement, and to make more complete information available in a displayed notice or on a dedicated page.

You should also plan how you will handle requests from people who wish to exercise their rights: who receives the request, how the requester’s identity is verified, and how the rights of other people visible in the same footage are protected.

Proportionality and retention

The system must be proportionate to its purpose. This principle comes down to a simple rule: collect only what you genuinely need. To measure queue length or how full a dining room is, you do not need to keep footage or know who is there; a counter is enough. In practical terms, this means:

• limiting camera coverage to the areas needed, and masking irrelevant parts of the image (public road, neighbouring shopfronts, workstations);
• strictly excluding private areas: toilets, changing rooms, staff rest rooms;
• favouring processing that keeps only aggregated results, with no footage and no identification;
• avoiding facial recognition and biometric identification unless they are truly essential, as such processing is subject to stricter rules;
• setting in advance a footage retention period limited to what is strictly necessary, with automatic deletion.

Employees: a particular point of attention

In the workplace, the employer must inform employees that cameras are in place and what they are used for, and consult staff representatives where required. The Labour Code and Law No. 09-08 apply together. Where cameras were originally installed for security, it is good practice to inform staff again when an analytics purpose is added.

A video system must not become a tool for continuously monitoring an employee at their workstation, or for assessing their individual productivity. Analytics that focus on flows and processes, such as the average waiting time in a queue or the occupancy of an area, are far easier to justify than analytics that target individuals.

Security and access to footage

The data controller must protect footage and results against unauthorised access. The basic measures are well known but too often overlooked: change the default passwords on cameras and recorders, isolate the video network, keep equipment updated, restrict access to footage to a few authorised people and log who views it.

Before going live, a short check helps avoid oversights: purposes described in writing, CNDP formality completed, signage installed, employees informed, masking zones configured, retention period set, list of authorised users agreed and contract with the provider signed.

On-site processing (Edge AI), which avoids sending video streams off the premises, helps reduce the risks. To find out more, our “Video Surveillance & Data Protection” page describes VIDEO.MA’s approach. We can help you prepare your project, alongside advice from your legal counsel.