Department Office of the Vice-President, Finance & AdministrationOCAD University acknowledges the ancestral territories of the Mississaugas of the Credit, the Haudenosaunee, the Anishinaabeg and the Huron-Wendat, who are the original owners and custodians of the land on which we live, work and createOCAD University, Canada's largest and oldest art and design university, is a vibrant community of bold, curious and compassionate artists, designers and scholars who are imagining and creating a joyful, equitable and sustainable world. The University is an internationally renowned hub for art, design, digital media, research, innovation and creativity, and arts administration. It embraces team-oriented and interdisciplinary approaches to change-making through art, design-thinking curriculum and research, making OCAD U a local, regional, national and global leader in art and design.It is an exciting time to join the OCAD U community as the University is at a key stage in its institutional transformation, with the implementation of its Academic and Strategic Plan and guiding principles — driving positive impact; decolonization, indigenization and equity; environmental sustainability; emerging as a vibrant hub; student centered approaches; innovation in learning teaching and research; and financial stewardship.Reporting to theVice-President, Finance and Administration(VPFA), thePrivacySpecialistacts asOCAD University'ssubject matter experton matters related to access to information, protection of privacy, and records management. Responsibilities include proper application ofaccess andprivacylegislation, processing access to information requests, promoting proper records retention and good record-keeping practices, completing privacy and security impact assessments, investigating privacy breaches and privacy complaints, and promoting a culture of privacy protectionand good information governance at theUniversity.The Privacy Specialist operates independently and exercises professional judgment while keeping the VPFA informed of significant privacy and records management matters, breaches, investigations, compliance issues and emerging institutional risks, and is responsible for ensuring the University is in compliance with relevant privacy and access legislation. The Specialist must have knowledge of legislative requirements and must maintain an ongoing awareness of developments in the areas of privacy and records management, and the implications of those developments for theUniversity.Summary of ResponsibilitiesPrivacy (70%)Independentlyprovideauthoritative adviceon the University's obligations underaccessand privacy legislationOntario'sFreedom of Information and Protection of Privacy Act(FIPPA) andPersonal Health InformationProtectionAct(PHIPA)arecollectively referred to as "Privacy Law".Prepare regular reports,analysesandstrategic advicefor the VPFAregardingprivacy compliance, records management, emerging risks, breaches,trendsand information governance mattersDevelop institutional privacy frameworks and provide strategic advice and recommendationsregardingprivacy, informationgovernanceand related institutional risksProvide information, guidance and advice to the University community andgeneral publicregardingquestions about privacy and information access requests at the UniversityRespond to the University's access for information requests, ensuring compliance with Privacy LawProvide guidance and information to requestors(both internal and external to the University)



with their access requestsDirect and coordinate the retrieval of informationrelevant to access requests with staff,facultyand administrationPrepare responses to requests for informationthrough review and consolidation of retrieved informationInterpret Privacy Lawin order tomake informed decisionsregardingthe application of exemptions and exclusions to the information requested, if applicable, including researching relevant orders and judicial review decisionsRespond and act on behalf of theUniversity when decisions on access are appealedtothe Information and Privacy Commissionerof Ontario(IPC)Receive and investigate privacy-related complaints, and respond to the IPC assigned analyst in cases of formal privacy complaints against the UniversityLead theresponse to privacy breaches at the University through the collection of relevant informationand providing subject matterexpertisetosenior administratorsfor informeddecision-makingWork withITin cases of cybersecurity incidents involving personal information.Coordinate any required involvement from legal counsel through liaising with the Office of the Vice-President, Finance and AdministrationSubmit all mandatory reporting to the IPCand prepares annual reports on Privacy Law compliance for the Audit, Finance and Risk Committee of the Board of GovernorsPlan, lead andconduct Privacy Impact AssessmentsWorkclosely withInformation Technology staff to evaluate and provide authoritative recommendations onPrivacy and SecurityImpact AssessmentsforITsolutionsProvide advice and recommendations on information technology projects,privacy implications of emerging technologies (i.E. AI solutions/applications)or other initiatives involving personal informationbeing implemented across or in different units at the University, which may have an impact on privacy, confidentiality, or records retentionCollaborate and communicate withprivacy and access colleagues at other universities across Ontarioto ensure best practices and up-to-datemethods are maintainedKeep up-to-date with new developments in Privacy Law, as well as directives fromtheIPC officeAct as privacy/information subject matter expert on relevant committees and working groupsDevelop and provide training to member of the University communityabout their obligations under Privacy LawRecords Management (30%)Developandmaintainthe University's records management frameworkbyactivelyparticipatingon the Records and Information Management Advisory Committee andoverseeingexisting policies and proceduresas they relate to the RIM programProvides leadership and guidanceto the University communityon records management and retention best practicesAdvise on and recommend best practices for records managementto departments, particularly in relation with Privacy LawProvide advice andassistanceto units in the implementation of records managementprocedures and practices, including assisting with file plans, retention schedules,



and the management of recordsAdvisesenior administrationon records management issues as they affect long-term reliability andaccessibilityof University recordsAct assubject matter expert on record managementonrelevantcommittees and working groupsPromote and encourage awareness of the role and importance of records managementinthe University communitythrough training,educationand effective communicationMonitor and audit the records management program at the UniversityStayup-to-dateon best practices in the field of records management and information governanceContinuallymonitorchanges and new developments in provincial and federal statutes and regulations that affect the management and retention ofUniversityrecordsQualificationsUndergraduate degreerequired; a graduate degree and/or certification in a related field (e.G.CIPP/C, CRM, MLIS) is considered an assetMinimum ofsix (6)yearsof experience in the field of privacy and records management, preferablyin apublic sector environmentExperience reviewing and interpreting relevant statutes,regulationsand case lawExtensiveknowledge of FIPPAandPHIPA, with some knowledge ofCanada's Anti-Spam Legislation, General Data Protection Regulation,Personal Information Protection and Electronic Documents Actand related legislation and regulationsDemonstrated research and analytical skillsDemonstratedability to deal with sensitive and confidential information inan appropriateand effective mannerAbility todeterminethe dissemination ofvarious typesof sensitive and/or confidential informationStrong communicationskills, including the ability to explain complex matters in plain language and the ability to writeclearly and succinctly in a variety of formats (policies, procedures, bulletins, training guides, etc.)Expected to be self-directed in responding to requests, complaints, breaches, and questionsExceptional organizational skills and the ability to work independently while coordinating one's own work with that of several officesProfessional demeanor and ability to relate effectively with senior administrators, staff,facultyand external stakeholdersThorough knowledge of records managementtheory andmethodologyAbility toprioritize activities, recognize urgent matters amongst multiple requests, all with competing deadlines and prioritizes informationthat needs to be dealt withimmediatelyFamiliarity with information technology as it relates to matters of privacy,securityand protection of personal informationStrong project management and change management skillsStrong focus on excellence in customer service and project leadershipUnderstanding of the business requirements of an academic institution and the ability toidentifythe needs of university departmentsDemonstrated commitment to the principles of equity and diversity and experience promoting an inclusive work and learning environmentMust be willing and able to provide regular flexibility with respect to hours of workMode of Work: HybridCompensation: Hiring Range - $84,311.75 to $96,656.35 per annum, commensurate with experience, plus benefits; Salary Range - $84,311.75 to $110,808.36 per annum.Hours of Work: Monday to Friday, 35 hours per week.As an employer committed to employment equity, we encourage applications from members of equity-deserving communities including women, racialized and Indigenous persons,persons with disabilities, and persons of all sexual orientations and gender identities/expressions.All qualified persons are encouraged to apply; however, Canadians and permanent residents of Canada will be given priority. While we thank all candidates for their interest, only those short-listed will be contacted.

📌 Privacy Specialist (Toronto)
🏢 OCAD University
📍 Toronto