Company: OCEA
Filing Date: 2025-04-08
Form Type: 10-K
Source: 0001641172-25-003155
Chunk: 2259

Company: Ocean Biomedical, Inc.
Filing Date: 2025-04-08
Form: 10-K
Item: Item 1A
Chunk 2259
---
 opt out of certain personal information sharing, and receive detailed information about how their
personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches
that is expected to increase data breach litigation. The CCPA (a) allows enforcement by the California Attorney General, with fines set
at $2,500 per violation (i.e., per person) or $7,500 per intentional violation and (b) authorizes private lawsuits to recover statutory
damages for certain data breaches. Additionally, on November 3, 2020, California voters approved the California Privacy Rights Act or
CPRA ballot initiative. The CPRA, which will come into effect on January 1, 2023, will significantly modify the CCPA and expand the privacy
rights of California residents. We cannot yet predict the impact of the CPRA on our business or operations, but it may require us to
incur additional costs and expenses. While there is currently an exception for protected health information that is subject to HIPAA
and clinical trial regulations, as currently written, the CCPA may impact certain of our business activities. The new California law
may lead to similar laws in other U.S. states or at a national level, which could increase our potential liability and adversely affect
our business.

In
addition to our operations in the United States, which may be subject to healthcare and other laws relating to the privacy and security
of health information and other personal information, may seek to conduct clinical trials in EEA and may become subject to additional
European data privacy laws, regulations and guidelines. The GDPR, became effective on May 25, 2018, and deals with the collection, use,
storage, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals in the EEA.
The GDPR has extra-territorial application and applies not only to organizations with a presence in the EU or the UK but also to businesses
based outside the EU or the UK that carry out processing that is related to (i) an offer of goods or services to individuals in the EU
or the UK, or (ii) the monitoring of their behavior so long as this takes place in the EU or the UK, even if the data is stored outside
the EU or the UK. Running clinical trials involving participants in the EU or the UK and processing personal data in the context of that
activity will trigger the application of the GDPR. The GDPR imposes