Company: OCEA
Filing Date: 2025-04-08
Form Type: 10-K
Source: 0001641172-25-003155
Chunk: 2665

Company: Ocean Biomedical, Inc.
Filing Date: 2025-04-08
Form: 10-K
Item: Item 1
Chunk 2665
---
 collection, use,
storage, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals in the EEA.
The GDPR has extra-territorial application and applies not only to organizations with a presence in the EU or the UK but also to businesses
based outside the EU or the UK that carry out processing that is related to (i) an offer of goods or services to individuals in the EU
or the UK, or (ii) the monitoring of their behavior so long as this takes place in the EU or the UK, even if the data is stored outside
the EU or the UK. Running clinical trials involving participants in the EU or the UK and processing personal data in the context of that
activity will trigger the application of the GDPR. The GDPR imposes a broad range of strict requirements on companies subject to the
GDPR, including requirements relating to having legal bases for processing personal information relating to identifiable individuals
and restrictions on cross-border data transfers unless a legal mechanism as set out in the GDPR can be relied on, such as transferring
such information outside the EEA, including to the United States, (as detailed further below) providing details to those individuals
regarding the processing of their personal health and other sensitive data, obtaining consent of the individuals to whom the personal
data relates, keeping personal information secure, having data processing agreements with third parties who process personal information,
responding to individuals’ requests to exercise their rights in respect of their personal information, reporting security breaches
involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers,
conducting data protection impact assessments, and record-keeping.

120

The
EU and UK may introduce further conditions, including limitations which could limit our ability to collect, use and share personal data
(including health and medical information), or could cause our compliance costs to increase. In addition, the GDPR imposes strict rules
on the transfer of personal data out of the EU/UK to third countries deemed to lack adequate privacy protections (including the United
States), unless an appropriate safeguard specified by the GDPR is implemented, such as the Standard Contractual Clauses, or SCCs, approved
by the European Commission, or a derogation applies. The Court of Justice of the European Union, or CJEU, recently deemed that the SCCs
are valid. However, the CJEU ruled that transfers made pursuant to the SCCs and other alternative transfer mechanisms need to be analyzed
on a case-by-case basis to