Company: XAIR
Filing Date: 2025-06-20
Form Type: 10-K
Source: 0001641172-25-015750
Chunk: 762

Company: Beyond Air, Inc.
Filing Date: 2025-06-20
Form: 10-K
Item: Item 1A
Chunk 762
---
 adopted an Adequacy Decision concerning the level of personal data protection in the UK under which personal data may now flow freely from the EU to the UK. However, personal data transfers from the EU to the UK may nevertheless be at a greater risk than before because the Adequacy Decision could in theory someday be suspended. On December 13, 2022, the European Commission adopted a draft adequacy decision for the EU-U.S. Data Privacy Framework. This draft decision follows the signature of a U.S. Executive Order by President Biden on October 7, 2022, along with the regulations issued by the U.S. Attorney General Merrick Garland. These two instruments implemented into U.S. law the agreement in principle announced by President von der Leyen and President Biden in March 2022. The draft decision concludes that the U.S. ensures an adequate level of protection for personal data transferred from the EU to U.S. companies. On February 14, 2023, the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs published its draft motion for a resolution regarding the adequacy of the protection of personal data. On February 28, 2023, the European Data Protection Committee (EDPB) published its Opinion 5/2023 on the European Commission’s draft adequacy decision. The two sides are now expected to finalize the details of this agreement and translate it into legal texts that will form the basis of a draft adequacy decision to be proposed by the European Commission; and

    ●
    the legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing amount of focus on privacy and data security issues with the potential to affect our business. For example, the CCPA, as amended by the California Privacy Rights Act (CPRA), contains disclosure obligations for businesses that collect personal information about California residents and affords those individuals new rights relating to their personal information that may affect our ability to use personal information. Other states, including Virginia, Colorado, Utah, Connecticut, Indiana, Iowa, Tennessee, Utah, and others have enacted privacy laws similar to the CCPA that impose new obligations or limitations in areas affecting our business and we continue to assess the impact of these state legislation, on our business as additional information and guidance becomes available. The federal government has also considered similar privacy laws that could impose new obligations or limitations in areas affecting our business.

These privacy and data security
laws and regulations could increase our cost of doing business, and failure to comply with these laws and