Company: OCEA
Filing Date: 2025-04-08
Form Type: 10-K
Source: 0001641172-25-003155
Chunk: 2666

Company: Ocean Biomedical, Inc.
Filing Date: 2025-04-08
Form: 10-K
Item: Item 1
Chunk 2666
---
 ensure EU standards of data protection are met in the jurisdiction where the data importer is based, and there
continue to be concerns about whether the SCCs and other mechanisms will face additional challenges. European regulators have issued
recent guidance following the CJEU ruling that imposes significant new diligence requirements on transferring data outside the EEA, including
under an approved transfer mechanism. This guidance requires an “essential equivalency” assessment of the laws of the destination
country. If essentially equivalent protections are not available in the destination country, the exporting entity must then assess if
supplemental measures can be put in place that, in combination with the chosen transfer mechanism, would address the deficiency in the
laws and ensure that essentially equivalent protection can be given to the data. Complying with this guidance will be expensive and time
consuming and may ultimately prevent us from transferring personal data outside the EEA, which would cause significant business disruption.
Until the legal uncertainties regarding how to legally continue transfers pursuant to the SCCs and other mechanisms are settled, we will
continue to face uncertainty as to whether our efforts to comply with our obligations under the GDPR will be sufficient. This and other
future developments regarding the flow of data across borders could increase the complexity of transferring personal data across borders
in some markets and may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could have
an adverse effect on our reputation and business.

In
addition, following the UK’s exit from the European Union, or Brexit, on January 31, 2020 and the transition period through December
31, 2020 during which the GDPR continued to apply in the UK, on January 1, 2021, the GDPR was brought into UK law as the ‘UK GDPR.’
On June 28, 2021, the EU Commission adopted two adequacy decisions for the UK, which enabled the free flow of data from the EU to the
UK, where the level of data protection is essentially the same as that guaranteed under EU law. Nonetheless, there may be further developments
about the regulation of particular issues such as UK-EU data transfers that may require us to take steps to ensure the lawfulness of
our data transfers.

The
GDPR increases substantially the penalties to which we could be subject in the event of any non-compliance, including fines of up to
10,000,000 Euros or up to 2% of our total worldwide annual turnover for certain comparatively minor offenses, or up to 20,000