Company: BDRX
Filing Date: 2025-01-28
Form Type: 424B3
Source: 0001214659-25-001409
Chunk: 72

Company: Biodexa Pharmaceuticals Plc
Filing Date: 2025-01-28
Form: 424B3
Chunk 72
---
 requirements pertaining to health data and pseudonymized (i.e., key-coded) data, increased cyber security requirements, new rights for individuals to be “forgotten” and rights to data portability, as well as enhanced current rights (e.g., access requests), mandatory data breach notification requirements and higher standards for controllers to demonstrate that they have obtained a valid legal basis for certain data processing activities. In particular, medical or health data, genetic data and biometric data are all classified as “special category” data under the GDPR and the UK GDPR, and afforded greater protection and require additional compliance obligations. Further, the GDPR provides that European Union member states may make their own further laws and regulations in relation to the processing of genetic, biometric or health data, which could result in differences between member states, limit our ability to use and share personal data or could cause our costs to increase, and harm our business and financial condition.

The GDPR the UK GDPR also regulate the transfer of personal data subject to the GDPR or UK GDPR to so-called third countries that have not been found by the European Commission to provide an adequate level of data protection. The GDPR and UK GDPR only permit exports of personal data outside of the EU and UK, respectively, to “non-adequate” countries where there is a suitable data transfer mechanism in place to safeguard personal data. As from 2020, legal developments in Europe have created complexity and uncertainty regarding such transfers. For instance, on July 16, 2020, the Court of Justice of the European Union, or CJEU, invalidated, by means of the so-called Schrems IIjudgment, the E.U.-U.S. Privacy Shield Framework, or the Privacy Shield, under which personal data could be transferred from the EEA to U.S. entities who had self-certified under the Privacy Shield scheme. However, on July 10, 2023, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the European Union to the United States – the E.U.-U.S. Data Privacy Framework, which provides E.U. individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data, and allows U.S. companies to self-certify to the U.S. Department of Commerce their compliance with a set of agreed privacy principles in order to freely receive E.U. personal data. The adequacy decision followed the signing of an executive order in the U.S. introducing new binding safeguards to