Privacy Impact Assessment Specialist

vTech Solution; Ontario; Hybrid; CAD 90,000 - 130,000; Full time

Job summary

A leading company in Ontario is seeking a highly experienced Privacy Impact Assessment Specialist. The successful candidate will possess over 10 years of expertise in methodologies and tools, and will be responsible for developing assessments, advising on privacy regulations, and collaborating with various stakeholders. This role offers a hybrid work arrangement with a focus on enhancing privacy practices within the organization.

Qualifications

• 10+ years' experience in privacy impact assessment methodologies.
• Practical knowledge of information technology concepts.
• Experience with federal/provincial healthcare providers is a plus.

Responsibilities

• Develop and review privacy impact assessments.
• Ensure compliance with PHIPA and related regulations.
• Engage with stakeholders for privacy-related discussions.

Skills

Privacy impact assessment methodologies

Threat and risk analysis

Policy development

Information technology concepts

Stakeholder engagement

Compliance with privacy regulations

Data flow analysis

Communication skills

Risk management

Consultation and negotiation

Education

Relevant degree in Information Management or similar

Job description

Job Summary:
This Privacy Impact Assessment Specialist role requires a highly experienced professional with a minimum of 10 years' experience in privacy impact assessment methodologies, application of threat and risk analysis, policy development, and information technology concepts related to personal information protection. The specialist will lead and provide technical expertise in developing access and privacy tools, engage with stakeholders, assess program proposals, ensure compliance with privacy regulations (e.g., PHIPA), advise on data flows and security mechanisms, and formulate policy recommendations. The role involves significant collaboration with various stakeholders, including business units, IT, legal, and government agencies. Location: Ontario, Canada
Responsibilities: - Develop privacy impact assessments and review recommendations.
- Lead and provide technical expertise in developing access and privacy tools.
- Facilitate privacy-related discussions with various stakeholders.
- Examine program proposals to assess business flow and context, perform stakeholder analysis, and assess feasibility regarding PHI protection.
- Ensure compliance with security and privacy best practices (e.g., PHIPA).
- Provide technical and systems advice on legacy systems and data flows.
- Develop business processes and procedures describing information flows associated with new technologies.
- Document physical and/or logical separation of PHI or security mechanisms.
- Provide privacy expertise and consultation to project teams and senior management.
- Advise ministries on Freedom of Information Act (FOI) and privacy implications.
- Recommend mitigation strategies and privacy-enhancing technologies.
- Identify and assess emerging policy issues related to FOI and privacy.
- Formulate policy proposals and recommendations.
- Prepare and present status reports to governance bodies.
- Assess existing regulations for potential changes to support greater access to PHI.
- Develop and provide change management support and communications.
- Provide advice to the Ministry on privacy policy and guidelines.
- Coordinate across branches and develop communication materials.
- Consult and gather input from individuals on privacy topics.
- Communicate with technical and business audiences.
Required Skills & Certifications: - 10+ years of experience in privacy impact assessment methodologies, tools, and techniques.
- Application of threat and risk analysis principles, program analysis, and business analysis.
- Understanding of policy development to lead or participate in developing options and strategies on information management and privacy protection.
- Practical knowledge of information technology concepts and processes impacting personal information protection.
- Practical knowledge of broad political, legal, fiscal, social, and governance dimensions to ensure privacy principles are considered in new programs/initiatives.
- Experience managing privacy risks in the collection, use, and disclosure of PHI.
- Leading end-to-end operational risk assessments.
- Implementing information privacy best practices.
- Demonstrated experience and competency to resolve complex issues, identify options, and make recommendations.
- Demonstrated experience and competency to analyze policy proposals, identify I&IT business implications, and develop strategic policy planning options and impact analyses.
- Demonstrated experience and competency to acquire and apply relevant legislation, regulations, and directives to ensure proposed initiatives conform to legislation.
- Demonstrated experience and competency to identify and evaluate emerging privacy issues, changes, and trends impacting government policy directions.
- Experience in program analysis/evaluation techniques.
- Demonstrated experience and competency to prepare comprehensive reports, options analyses, briefing materials, presentations, and propose responses on privacy issues.
- Experience in consultation and negotiation to gain support for policy and program initiatives.
- Demonstrated experience and competency to develop effective relationships with senior management and stakeholders.
- Strong oral and written communication skills.
- 5+ years of experience working with federal/provincial/broader public-sector healthcare providers.
- Previous Public Sector experience and familiarity with privacy and de-identification guidelines.
Preferred Skills & Certifications: - Knowledge of Public Sector Enterprise Architecture artifacts, processes, and practices.
- In-depth knowledge of industry standards such as Project Management Institute (PMI).
- Knowledge of Public Sector I&IT project management methodologies.
- Knowledge and experience with Public Sector or Broader Public-Sector health-related projects.
- Knowledge and understanding of Ministry policy and IT project approval processes and requirements.
- Experience adopting and adhering to Public Sector Unified I&IT Project Methodology.
- Experience with large complex IT Health-related projects.
- Experience with GO-ITS Digital Health standards and internal branch standards.
Special Considerations: - Hybrid work arrangement requiring 3 days onsite and 2 days remote.
- Contract extension allowed only using unused days/funds. No additional funds will be added.
Scheduling: - Hybrid schedule with 3 days onsite and 2 days remote, at the Hiring Manager's discretion.