Company: IOBT
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047744
Chunk: 203

Company: IO Biotech, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 203
---
 safeguard personal data and to report certain personal data breaches to the supervisory authority without undue delay (and no later than 72 hours where feasible); and (4) additional, more onerous requirements around the processing of special categories of personal data (including health data and genetic data). In addition, the EU GDPR prohibits the transfer of personal data from the EEA to the United States and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws unless a data transfer mechanism has been put in place. In July 2020, the Court of Justice of the EU (“CJEU”) in the Schrems II decision limited how organizations could lawfully transfer personal data from the EEA to the United States by invalidating the EU-US Privacy Shield for purposes of international transfers and imposing further restrictions on use of the standard contractual clauses (“SCCs”), including a requirement for companies to carry out a transfer impact assessment, which among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an essentially equivalent level of data protection to that afforded in the EEA. The European Commission subsequently issued new SCCs in June 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board and which are in turn relatively more onerous. At present, there are few, if any, viable alternatives to the SCCs. However, on October 7, 2022, the Biden administration introduced an Executive Order to facilitate a new Trans-Atlantic Data Privacy Framework which will act as a successor to the invalidated EU-US Privacy Shield. On December 13, 2022, the European Commission also published its draft adequacy decision to reflect its view that the new Executive Order and Trans-Atlantic Data Privacy Framework, is able to meet the concerns raised in Schrems II. If the draft adequacy decision is approved and implemented, the agreement will facilitate the transatlantic flow of personal data and provide additional safeguards to data transfer mechanisms (including SCCs and Binding Corporate Rules) for companies transferring personal data from the EU to the US. However, before parties rely on the new framework, there are still legislative and regulatory steps that must be undertaken both in the US and in the EU. The EU GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of consolidated annual worldwide gross revenue), and confers a private