Company: OCEA
Filing Date: 2025-04-08
Form Type: 10-K
Source: 0001641172-25-003155
Chunk: 3560

Company: Ocean Biomedical, Inc.
Filing Date: 2025-04-08
Form: 10-K
Item: Item 1A
Chunk 3560
---
 a broad range of strict requirements on companies subject to the
GDPR, including requirements relating to having legal bases for processing personal information relating to identifiable individuals
and restrictions on cross-border data transfers unless a legal mechanism as set out in the GDPR can be relied on, such as transferring
such information outside the EEA, including to the United States, (as detailed further below) providing details to those individuals
regarding the processing of their personal health and other sensitive data, obtaining consent of the individuals to whom the personal
data relates, keeping personal information secure, having data processing agreements with third parties who process personal information,
responding to individuals’ requests to exercise their rights in respect of their personal information, reporting security breaches
involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers,
conducting data protection impact assessments, and record-keeping.

120

The
EU and UK may introduce further conditions, including limitations which could limit our ability to collect, use and share personal data
(including health and medical information), or could cause our compliance costs to increase. In addition, the GDPR imposes strict rules
on the transfer of personal data out of the EU/UK to third countries deemed to lack adequate privacy protections (including the United
States), unless an appropriate safeguard specified by the GDPR is implemented, such as the Standard Contractual Clauses, or SCCs, approved
by the European Commission, or a derogation applies. The Court of Justice of the European Union, or CJEU, recently deemed that the SCCs
are valid. However, the CJEU ruled that transfers made pursuant to the SCCs and other alternative transfer mechanisms need to be analyzed
on a case-by-case basis to ensure EU standards of data protection are met in the jurisdiction where the data importer is based, and there
continue to be concerns about whether the SCCs and other mechanisms will face additional challenges. European regulators have issued
recent guidance following the CJEU ruling that imposes significant new diligence requirements on transferring data outside the EEA, including
under an approved transfer mechanism. This guidance requires an “essential equivalency” assessment of the laws of the destination
country. If essentially equivalent protections are not available in the destination country, the exporting entity must then assess if
supplemental measures can be put in place that, in combination with the chosen transfer mechanism, would address the deficiency in the
laws and ensure that essentially equivalent protection can be given to the data. Complying with this guidance will be expensive