Company: CRVO
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001437749-25-007829
Chunk: 105

Company: CervoMed Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1A
Chunk 105
---
 to the GDPR, and the Company may be required to put in place additional mechanisms to ensure compliance with the GDPR, including as implemented by individual countries. Ensuring the Company’s continued compliance with the GDPR is a rigorous and time-intensive process that may increase the Company’s cost of doing business or require us to change the Company’s business practices, and despite those efforts, there is a risk that the Company may be subject to fines and penalties, litigation, and reputational harm in connection with the Company’s European activities. Many jurisdictions outside of U. S. and Europe are also considering and/or enacting comprehensive data protection legislation that could have an impact on market expansion and clinical trials as well.

Additionally, following the United Kingdom’s withdrawal from the European Union (i. e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the GDPR has been implemented in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR - the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover.

Transfers of personal data to certain countries outside of the EEA and the UK are also highly regulated under the GDPR and UK GDPR. For example, the GDPR only permits exports of personal data outside of the EEA to “non-adequate” countries where there is a suitable data transfer mechanism in place to safeguard personal data (e. g., the EU Commission approved Standard Contractual Clauses or certification under the Data Privacy Framework). On July 16, 2020, the Court of Justice of the EU, or the CJEU, issued a landmark opinion in the case Maximilian Schrems vs. Facebook (Case C-311/18) (Schrems II). This decision calls into question certain data transfer mechanisms as between the EU member states and the U. S. The CJEU is the highest court in Europe and the Schrems II decision heightened the burden to assess U. S. national security laws on their business, and future actions of EEA data protection authorities are difficult