Company: MYND
Filing Date: 2025-03-26
Form Type: 20-F
Source: 0001628280-25-014832
Chunk: 19

Company: Mynd.ai, Inc.
Filing Date: 2025-03-26
Form: 20-F
Item: Item 3
Chunk 19
---
 delivery of advertisements to students or the creation of a profile of a student’s online behavior for the purpose of delivering targeted advertisements. These student data privacy laws generally limit the processing of student data only as necessary to deliver the specific product or service that the students’ data was originally collected for, and for no other purposes. Ensuring compliance with the range of obligations created by these state student data privacy laws is an ongoing commitment that involves substantial costs. If any of our student personal data processing activities within many US states are found to violate state law requirements, we may incur substantial fines, have to change our business practices, and face reputational harm, any of which could have an adverse effect on our business; and

• Laws such as SB-327 in California and the EU regulation 2023/2854 (the “ Data Act”) (which came into force in January 2024 and will become applicable in September 2025) regulate the security of data in connection with internet connected devices and ensuring compliance with the range of obligations created by these state student data privacy laws is an ongoing commitment that involves substantial costs. If any of our data processing activities are found to violate the requirements imposed by these internet of things or connected devices laws, we may incur substantial fines, have to change our business practices, and face reputational harm, any of which could have an adverse effect on our business.

Further, we are subject to evolving laws and regulations that dictate whether, how, and under what circumstances we can transfer, process and/or receive personal data. On July 10, 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (“ DPF”). The DPF is the successor to the EU-US privacy shield, which the Court of Justice of the European Union (CJEU) declared invalid in 2020. The adequacy decision means that U. S. businesses that self-certify under the DPF no longer require separate data transfer mechanisms in order to transfer personal data from the European Union to the U. S. Self-certified companies to the DPF will be able to freely transfer personal data from the European Economic Area to the U. S. without having to conduct a data transfer impact assessment (DTIA) or implement supplemental measures. However, any company which relies on other data transfer mechanisms, such as Standard Contractual Clauses (SCCs), may have to adapt its existing contractual arrangements to incorporate DTIA before transferring data. The validity of data transfer mechanisms remains subject to legal, regulatory, and political