Reporting to the Vice-President, Finance and Administration (VPFA), the Privacy Specialist acts as OCAD University’s subject matter expert on matters related to access to information, protection of privacy, and records management. Responsibilities include proper application of access and privacy legislation, processing access to information requests, promoting proper records retention and good record-keeping practices, completing privacy and security impact assessments, investigating privacy breaches and privacy complaints, and promoting a culture of privacy protection and good information governance at the University.
The Privacy Specialist operates independently and exercises professional judgment while keeping the VPFA informed of significant privacy and records management matters, breaches, investigations, compliance issues and emerging institutional risks, and is responsible for ensuring the University is in compliance with relevant privacy and access legislation. The Specialist must have knowledge of legislative requirements and must maintain an ongoing awareness of developments in the areas of privacy and records management, and the implications of those developments for the University.
Summary of Responsibilities:
Privacy (70%)
- Independently provide authoritative advice on the University’s obligations under access and privacy legislation Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Health Information Protection Act (PHIPA) are collectively referred to as “Privacy Law”.
- Prepare regular reports, analyses and strategic advice for the VPFA regarding privacy compliance, records management, emerging risks, breaches, trends and information governance matters
- Develop institutional privacy frameworks and provide strategic advice and recommendations regarding privacy, information governance and related institutional risks
- Provide information, guidance and advice to the University community and general public regarding questions about privacy and information access requests at the University
- Respond to the University’s access for information requests, ensuring compliance with Privacy Law
- Provide guidance and information to requestors (both internal and external to the University) with their access requests
- Direct and coordinate the retrieval of information relevant to access requests with staff, faculty and administration
- Prepare responses to requests for information through review and consolidation of retrieved information
- Interpret Privacy Law in order to make informed decisions regarding the application of exemptions and exclusions to the information requested, if applicable, including researching relevant orders and judicial review decisions
- Respond and act on behalf of the University when decisions on access are appealed to the Information and Privacy Commissioner of Ontario (IPC)
- Receive and investigate privacy-related complaints, and respond to the IPC assigned analyst in cases of formal privacy complaints against the University
- Lead the response to privacy breaches at the University through the collection of relevant information and providing subject matter expertise to senior administrators for informed decision-making
- Work with IT in cases of cybersecurity incidents involving personal information.
- Coordinate any required involvement from legal counsel through liaising with the Office of the Vice-President, Finance and Administration
- Submit all mandatory reporting to the IPC and prepares annual reports on Privacy Law compliance for the Audit, Finance and Risk Committee of the Board of Governors
- Plan, lead and conduct Privacy Impact Assessments
- Work closely with Information Technology staff to evaluate and provide authoritative recommendations on Privacy and Security Impact Assessments for IT solutions
- Provide advice and recommendations on information technology projects, privacy implications of emerging technologies (i.e. AI solutions/applications) or other initiatives involving personal information being implemented across or in different units at the University, which may have an impact on privacy, confidentiality, or records retention
- Collaborate and communicate with privacy and access colleagues at other universities across Ontario to ensure best practices and up-to-date methods are maintained
- Keep up-to-date with new developments in Privacy Law, as well as directives from the IPC office
- Act as privacy/information subject matter expert on relevant committees and working groups
- Develop and provide training to member of the University community about their obligations under Privacy Law
Records Management (30%)
- Develop and maintain the University’s records management framework by actively participating on the Records and Information Management Advisory Committee and overseeing existing policies and procedures as they relate to the RIM program
- Provides leadership and guidance to the University community on records management and retention best practices
- Advise on and recommend best practices for records management to departments, particularly in relation with Privacy Law
- Provide advice and assistance to units in the implementation of records management procedures and practices, including assisting with file plans, retention schedules, and the management of records
- Advise senior administration on records management issues as they affect long-term reliability and accessibility of University records
- Act as subject matter expert on record management on relevant committees and working groups
- Promote and encourage awareness of the role and importance of records management in the University community through training, education and effective communication
- Monitor and audit the records management program at the University
- Stay up-to-date on best practices in the field of records management and information governance
- Continually monitor changes and new developments in provincial and federal statutes and regulations that affect the management and retention of University records
Qualifications:
- Undergraduate degree required; a graduate degree and/or certification in a related field (e.g. CIPP/C, CRM, MLIS) is considered an asset
- Minimum of six (6) years of experience in the field of privacy and records management, preferably in a public sector environment
- Experience reviewing and interpreting relevant statutes, regulations and case law
- Extensive knowledge of FIPPA and PHIPA, with some knowledge of Canada’s Anti-Spam Legislation, General Data Protection Regulation, Personal Information Protection and Electronic Documents Act and related legislation and regulations
- Demonstrated research and analytical skills
- Demonstrated ability to deal with sensitive and confidential information in an appropriate and effective manner
- Ability to determine the dissemination of various types of sensitive and/or confidential information
- Strong communication skills, including the ability to explain complex matters in plain language and the ability to write clearly and succinctly in a variety of formats (policies, procedures, bulletins, training guides, etc.)
- Expected to be self-directed in responding to requests, complaints, breaches, and questions
- Exceptional organizational skills and the ability to work independently while coordinating one’s own work with that of several offices
- Professional demeanor and ability to relate effectively with senior administrators, staff, faculty and external stakeholders
- Thorough knowledge of records management theory and methodology
- Ability to prioritize activities, recognize urgent matters amongst multiple requests, all with competing deadlines and prioritizes information that needs to be dealt with immediately
- Familiarity with information technology as it relates to matters of privacy, security and protection of personal information
- Strong project management and change management skills
- Strong focus on excellence in customer service and project leadership
- Understanding of the business requirements of an academic institution and the ability to identify the needs of university departments
- Demonstrated commitment to the principles of equity and diversity and experience promoting an inclusive work and learning environment
- Must be willing and able to provide regular flexibility with respect to hours of work
Mode of Work: Hybrid
Compensation: Hiring Range - $84,311.75 to $96,656.35 per annum, commensurate with experience, plus benefits; Salary Range - $84,311.75 to $110,808.36 per annum.
Hours of Work: Monday to Friday, 35 hours per week.