Company: MYSEW
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001013762-25-004290
Chunk: 22

Company: Myseum, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 22
---
 business.

In addition, the data protection landscape in
the EU is continually evolving, resulting in possible significant operational costs for internal compliance and risks to our business.
The EU adopted the General Data Protection Regulation (“GDPR”), which became effective in May 2018, and contains numerous
requirements and changes from previously existing EU laws, including more robust obligations on data processors and heavier documentation
requirements for data protection compliance programs by companies.

Among other requirements, the GDPR regulates
the transfer of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such
personal data, including the United States. Recent legal developments in Europe have created complexity and uncertainty regarding such
transfers. For instance, on July 16, 2020, the Court of Justice of the European Union (the “CJEU”) invalidated the EU-U.S.
Privacy Shield Framework (the “Privacy Shield”) under which personal data could be transferred from the European Economic
Area to U.S. entities who had self-certified under the Privacy Shield scheme. While the CJEU upheld the adequacy of the standard contractual
clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism and potential
alternative to the Privacy Shield), it made clear that reliance on such clauses alone may not necessarily be sufficient in all circumstances.
Use of the standard contractual clauses must now be assessed on a case-by-case basis taking into account the legal regime applicable
in the destination country, including, in particular, applicable surveillance laws and rights of individuals, and additional measures
and/or contractual provisions may need to be put in place; however, the nature of these additional measures is currently uncertain. The
CJEU also states that if a competent supervisory authority believes that the standard contractual clauses cannot be complied with in
the destination country and that the required level of protection cannot be secured by other means, such supervisory authority is under
an obligation to suspend or prohibit that transfer.

Additionally, the GDPR greatly increased the
European Commission’s jurisdictional reach of its laws and added a broad array of requirements for handling personal data. EU member
states are tasked under the GDPR to enact, and have enacted, certain implementing legislation that adds to and/or further interprets
the GDPR requirements and potentially extends our obligations and potential liability for failing to meet such obligations. The GDPR,
together with national legislation, regulations and guidelines of the EU member states a governing the processing of personal data, impose
strict obligations and restrictions on the ability to