Company: BDRX
Filing Date: 2025-01-17
Form Type: F-1
Source: 0001214659-25-000922
Chunk: 74

Company: Biodexa Pharmaceuticals Plc
Filing Date: 2025-01-17
Form: F-1
Chunk 74
---
The GDPR the UK GDPR also regulate the transfer of personal data subject to the GDPR or UK GDPR to so-called third countries that have not been found by the European Commission to provide an adequate level of data protection. The GDPR and UK GDPR only permit exports of personal data outside of the EU and UK, respectively, to “non-adequate” countries where there is a suitable data transfer mechanism in place to safeguard personal data. As from 2020, legal developments in Europe have created complexity and uncertainty regarding such transfers. For instance, on July 16, 2020, the Court of Justice of the European Union, or CJEU, invalidated, by means of the so-called Schrems IIjudgment, the E.U.-U.S. Privacy Shield Framework, or the Privacy Shield, under which personal data could be transferred from the EEA to U.S. entities who had self-certified under the Privacy Shield scheme. However, on July 10, 2023, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the European Union to the United States – the E.U.-U.S. Data Privacy Framework, which provides E.U. individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data, and allows U.S. companies to self-certify to the U.S. Department of Commerce their compliance with a set of agreed privacy principles in order to freely receive E.U. personal data. The adequacy decision followed the signing of an executive order in the U.S. introducing new binding safeguards to address the points raised in the Schrems IIjudgment. Notably, the new obligations were geared to ensure that data can be accessed by U.S. intelligence agencies only to the extent necessary and proportionate and to establish an independent and impartial redress mechanism to handle complaints from Europeans concerning the collection of their data for national security purposes. The UK-US Data Bridge (the UK extension to the Data Privacy Framework) came into force shortly after the E.U. – U.S. Data Privacy Framework, and provides UK individuals with similar rights. Organizations that have not certified under the under the E.U. – U.S. Data Privacy Framework (or the UK-US Data Bridge) may utilize another data transfer mechanism, such as the EU Commission approved Standard Contractual Clauses, or the UK equivalent, respectively. The European Commission and the UK government will continually review developments in the United States along with their adequacy decisions. Consequently, there