Company: DARE
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001401914-25-000012
Chunk: 168

Company: Dare Bioscience, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 168
---
, genetic data and biometric data where the latter is used to uniquely identify an individual are all classified as “special category” data under the GDPR and afforded greater protection and require additional compliance obligations. Further, EU member states have a broad right to impose additional conditions – including restrictions – on these data categories. This is because the GDPR allows EU member states to derogate from the requirements of the GDPR mainly in regard to specific processing situations (including special category data and processing for scientific or statistical purposes). As the EU member states continue to reframe their national legislation to harmonize with the GDPR, we will need to monitor compliance with all relevant EU member states’ laws and regulations, including where permitted derogations from the GDPR are introduced.

We will also be subject to evolving EU laws on data export, if we transfer data outside the EU to ourselves or third parties outside of the EU. The GDPR only permits exports of data outside the EU to countries deemed by the European Commission to have adequate data privacy laws or where there is a suitable data transfer solution in place to safeguard personal data (e.g., the European Union Commission approved Standard Contractual Clauses). On July 16, 2020, the Court of Justice of the European Union or the CJEU, issued a landmark opinion in the case Maximilian Schrems vs. Facebook (Case C-311/18), called Schrems II. This decision a) calls into question certain data transfer mechanisms as between the EU member states and the U.S. and b) invalidates the EU-U.S. Privacy Shield on which many companies had relied as an acceptable mechanism for transferring such data from the EU to the U.S. 

On July 10, 2023, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the EU to the United States – the EU-US Data Privacy Framework, which provides EU individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data. The adequacy decision followed the signing of an executive order introducing new binding safeguards to address the points raised in the Schrems II decision. Notably, the new obligations were geared to ensure that data can be accessed by U.S. intelligence agencies only to the extent necessary and proportionate and to establish an independent and impartial redress mechanism to handle complaints from Europeans concerning the collection of their data for national security purposes. The European Commission will continually review developments in the U.S. along with its adequacy decision. Adequ