Build a cross-border transfer mechanism table
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Make a table of the transfer direction, the countries named in the instructions, and the mechanism the instructions already identify. Add no mechanism the sources do not support.
- What the lawyer must review
- The Department of Commerce Data Privacy Framework site states that the EU-US Data Privacy Framework, the UK Extension, and the Swiss-US Data Privacy Framework give US organisations mechanisms for personal-data transfers to the United States from the European Union, the United Kingdom and Switzerland. That is not a general US ban on sending data out of the United States, and it is not an equivalent of a single statutory transfer rule. Confirm the organisation is on the Framework list before you record the Framework as the mechanism, and open the state privacy statute if the data are also subject to it. Model Rule 1.6 and Opinion 512: client transfer facts are confidential, and a public tool is the wrong place for them unless the client has agreed and the tool's terms hold.
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes identifying points for review. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.