Privacy Counsel and Data Protection Officer

Mecka; Canada; Sur place; CAD 150 000 - 180 000; Plein temps

Résumé du poste

Mecka is seeking a Privacy Counsel and Data Protection Officer to lead the privacy programme across markets and capture models. You will implement cross-border transfer frameworks, consent standards, and privacy by design with engineering, product, and operations teams.

You will advise on data protection obligations, manage incidents and regulatory inquiries, and coordinate internal and external counsel to ensure compliant data handling globally.

Qualifications

• Law degree and admission to practice in at least one jurisdiction.
• 5–8+ years of privacy and data protection practice, across settings.
• Demonstrated DPO independence; direct communication with management and regulators.
• Experience advising on cross-border transfers and multi-country regimes.
• Ability to translate privacy requirements into engineering controls.

Responsabilités

• Maintain and build privacy programme across markets and capture models.
• Advise on data protection requirements; monitor compliance; oversee DPIAs.
• Own consent and transparency frameworks; update notices and disclosures.
• Implement transfer mechanisms; manage regulator registrations and local filings.
• Partner with engineering to embed privacy by design (redaction, encryption, access).
• Lead incident response, data subject requests, and regulator inquiries.

Connaissances

Privacy compliance

Regulatory engagement

Cross-border data transfers

Policy development

Formation

Law degree

Description du poste

About Mecka AI

Mecka AI is building the data infrastructure layer for robotics and embodied AI.

We design and operate global systems for data capture, data labeling, and hardware-enabled workflows used by leading AI labs and robotics companies to train and validate humanoid and embodied AI systems.

We work closely with frontier robotics teams to bridge real-world data, simulation, learning-based systems, and deployed hardware.

About The Role

We collect egocentric video data for AI training through our own capture teams, through commercial partners, and through individual contributors using our mobile app. In each of these models, the questions that decide whether a market can operate are privacy questions: whether valid consent has been obtained, how footage leaves the country where it was recorded, and which registrations, filings, and regulatory appointments each operating entity needs.

As Privacy Counsel and Data Protection Officer, you will own the privacy programme across every market and capture model we run. You will maintain and update the consent standard our teams and partners follow, maintain and build upon the cross-border transfer and registration framework for each operating entity, and work with engineering and operations so that controls such as redaction, retention, deletion, and access limits continue to be considered in product design. You will be the first call for operations teams on privacy questions and will manage outside privacy counsel in each jurisdiction.

In your capacity as Data Protection Officer, you will independently advise the company on its data protection obligations, monitor compliance, and act as the lead point of contact for data subjects and supervisory authorities globally. You will have direct access to senior management, appropriate resources to perform the DPO function, and independence in carrying out your statutory responsibilities.

What You Will Do

• Privacy programme: Maintain and build upon the privacy and data protection programme across all markets and capture models, including records of processing, impact assessments, retention schedules, and policies that operating teams can apply without a legal review of every question. Develop and deliver privacy training for relevant employees, contractors, partners, and other stakeholders.
• Data Protection Officer: Independently advise the company and its personnel on applicable data protection requirements; monitor compliance with applicable laws and internal policies; advise on data protection impact assessments; and report material privacy risk. Serve as the point of contact for data subjects and supervisory authorities and cooperate with regulators where required.
• Consent: Own the consent and transparency framework for contributors, venue owners, and bystanders, maintain the approved consent forms, privacy notices, disclosures, and related records used in every capture model, and continue to update those standards into partner and vendor agreements.
• Cross-border data: Continue to implement and monitor the transfer mechanisms that let footage move from the country of capture to our storage and processing, and manage regulator registrations, local data protection representative appointments, and local filings for each operating entity.
• Privacy by design: Partner with engineering, product, security, and quality teams on redaction, encryption, access controls, data minimization, and deletion, and review new capture models, datasets, and customer deliveries before they go live.
• Incidents and counsel: Advise operations teams on the privacy conditions a market must meet before it opens, lead the response to data incidents, data subject requests, complaints, and regulator inquiries, including assessing notification and remediation obligations, and manage outside privacy counsel against clear scopes and budgets.

What You Bring

• Qualification: Law degree and admission to practice in at least one jurisdiction.
• Experience: 5 to 8+ years of privacy and data protection practice, with time both at a top tier law firm and in-house at a high-growth technology, marketplace, AI, or data company.
• DPO capabilities: Demonstrated ability to perform the DPO function independently and objectively; communicate directly with senior management and regulators .Multi-jurisdiction: Hands-on experience advising on data protection regimes in several countries at once, including consent, cross-border transfers, data protection impact assessments, data breach response, and regulator registration, and managing outside counsel across those countries.
• Technical and operational judgment: Ability to translate complex privacy requirements into practical controls for engineering, operations, and delivery teams.

Even better if you have

• Data type: Experience with video, image, biometric, or location data, or with datasets collected or processed for machine learning training.
• Certification: A privacy certification such as CIPP/E, CIPP/A, or CIPM.
• Industry: In-house experience at a marketplace, delivery, AI, data, or gig platform operating across emerging markets.
• SOC 2 compliance or audit-readiness initiatives is an asset.
• Regulatory engagement: Experience communicating with data protection authorities, responding to regulatory inquiries, and managing multi-jurisdictional personal data incidents.

If you don't check every box above but believe you can do the job, we encourage you to apply — we're looking for capability and trajectory, not a perfect checklist match.

We strive to create an inclusive work environment for all; we welcome applicants from all backgrounds and are committed to providing equal opportunities. Should you require any accommodations during the recruitment process, we will partner with you to meet your needs.

We may use AI-assisted tools to help evaluate applications against the requirements of this role. These tools support our recruiting team in identifying qualified candidates but do not replace human judgment or limit which applications may be reviewed or considered.

Compensation Range: $150K - $180K