Processing of sensitive data requires authorisation by a law setting the conditions or, failing that, by the CNDP, granted on the data subject's express consent or where processing is indispensable to the controller's legal or statutory functions, and also where it is necessary to protect vital interests of a person unable to consent, concerns data manifestly made public by the data subject whose consent can be inferred, or is necessary for legal claims and done solely for that purpose. By way of exception, health data processed solely for preventive medicine, diagnosis, care or health service management by a practitioner or other person bound by professional secrecy, or to select persons eligible for a right, benefit or contract, needs only a declaration. Otherwise genetic and health data processing requires CNDP authorisation with a dossier naming the persons responsible and with access, the research protocol and ethics opinions for medical research, and an undertaking to code identifying data (Decree Articles 29 and 30). Processing sensitive or criminal data without express consent is an offence punishable by 50,000 to 300,000 dirhams and imprisonment (Article 57).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.