A camera filming identifiable people produces personal data. As such it falls under law 09-08 and the oversight of the national commission. That is the point most installations overlook.
What is regulated
As soon as the images make it possible to identify a person, the system constitutes processing of personal data. It makes no difference whether the images are kept or simply watched live.
That means a declaration to the supervisory authority, a declared and legitimate purpose, visible notice to the people filmed, a limited retention period and restricted access.
Areas you do not film
Some spaces are excluded or strictly regulated:
- toilets and changing rooms, without exception
- staff break rooms and rest areas
- union premises
- an individual workstation filmed continuously, which amounts to disproportionate surveillance
- the public highway, absent specific authorisation
The guiding rule is proportionality: surveillance must answer an identified risk, not provide general oversight of employees’ activity.
Informing the people concerned
A visible sign at each entrance to a monitored area must state that the system exists, who is responsible for it and how rights can be exercised. For employees, the information must be individual and given beforehand, and staff representatives consulted where they exist.
A camera installed without prior notice produces images that are hard to use as evidence, on top of exposing the company to a penalty.
Retention of images
It must be limited to what the purpose requires. A short period, in the order of a few weeks, is reasonable practice for securing premises. Beyond that, the need has to be justified.
Technically, that means a recorder configured to overwrite the oldest footage automatically, not storage that accumulates indefinitely.
Access to the images
The list of authorised people must be short and documented. Each viewing should be logged. A recorder whose password is known to the entire technical department does not meet that requirement.
A point often neglected: a video surveillance system reachable from the internet with default credentials is a classic way into the company network. See our article on designing a business network.
Frequently asked questions
Does a system of just a few cameras have to be declared?
Yes. The number of cameras does not change the nature of the processing.
Can an image be used as proof of misconduct?
Only if the system was declared, the information given and the surveillance proportionate. An irregular system weakens the evidence.
Can the images be hosted abroad?
Transfer outside Morocco is regulated. To be checked with the supplier before choosing a solution.
Can we film a checkout continuously?
Filming the checkout area to deter theft is accepted. Permanently framing the cashier’s face amounts to disproportionate surveillance.
How we work
Systomap designs and installs video surveillance systems with the legal framework in mind: camera placement, retention periods, securing access and documentation. Talk to us.
