Company: DARE
Filing Date: 2025-04-24
Form Type: ARS
Source: 0001401914-25-000018
Chunk: 112

Company: Dare Bioscience, Inc.
Filing Date: 2025-04-24
Form: ARS
Chunk 112
---
 implementing a broad data protection framework that expanded the scope of EU data protection law, including to non-EU entities that process, or control the processing of, personal data relating to individuals located in the EU, including clinical trial data. The GDPR sets out a number of requirements that must be complied with when handling the personal data of European Union-based data subjects including: providing expanded disclosures about how their personal data will be used; limitations on retention of personal data, higher standards for organizations to demonstrate that they have obtained valid consent or have another legal basis in place to justify their data processing activities; requirements to conduct data protection impact assessments for "high risk" processing; the obligation to appoint data protection officers in certain circumstances; new rights for individuals to be “forgotten” and rights to data portability, as well as enhanced current rights (e.g., access requests); the principal of accountability and demonstrating compliance through policies, procedures, training and audit; and a new mandatory data breach regime. In particular, medical or health data, genetic data and biometric data where the latter is used to uniquely identify an individual are all classified as “special category” data under the GDPR and afforded greater protection and require additional compliance obligations. Further, EU member states have a broad right to impose additional conditions – including restrictions – on these data categories. This is because the GDPR allows EU member states to derogate from the requirements of the GDPR mainly in regard to specific processing situations (including special category data and processing for scientific or statistical purposes). As the EU member states continue to reframe their national legislation to harmonize with the GDPR, we will need to monitor compliance with all relevant EU member states’ laws and regulations, including where permitted derogations from the GDPR are introduced. We will also be subject to evolving EU laws on data export, if we transfer data outside the EU to ourselves or third parties outside of the EU. The GDPR only permits exports of data outside the EU to countries deemed by the European Commission to have adequate data privacy laws or where there is a suitable data transfer solution in place to safeguard personal data (e.g., the European Union Commission approved Standard Contractual Clauses). On July 16, 2020, the Court of Justice of the European Union or the CJEU, issued a landmark opinion in the case Maximilian Schrems vs. Facebook (Case C-311/18), called Schrems II. This decision a) calls into question certain data transfer mechanisms as between the EU member states and the U.S. and b) invalidates the EU