Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data 4: Article 4: consent unless a listed ground applies, including for communication to third parties

What does 4 require?

Processing may be carried out only if the data subject has unambiguously consented to the operation or set of operations, and data may be communicated to a third party only for purposes directly linked to the functions of the transferor and transferee and subject to the data subject's prior consent. Consent is not required where processing is necessary to comply with a legal obligation of the data subject or controller, to perform a contract with the data subject or pre-contractual steps at his or her request, to protect the data subject's vital interests where he or she cannot consent, to perform a public interest task or official authority vested in the controller or recipient third party, or for the legitimate interest of the controller or recipient provided the data subject's interest or fundamental rights and freedoms are not disregarded. Processing in breach of Article 4 is an offence under Article 56.