RQ11837 - Privacy Impact Assessment (PIA) Specialist - Senior

- Required to lead and support the development of a Privacy ImpactAssessment (PIA) report, which evaluates whether current technologies, informationsystems or proposed programs and policies meet legal and privacy requirements,determines and guides risk mitigations, and addresses clients’ concerns.

- These requirements include ensuring program compliance withapplicable privacy statutes (provincial, federal, or municipal) and privatesector access and privacy legislation, as well as relevant regulations, programstatutes, OPS policies, Management Board of Cabinet Directives, standards,guidelines and internationally established Fair Information Principles andindustry best practices.

- Following several methodologies (PIA methodology, businessanalysis, risk analysis principles, information management lifecycle) toprepare in-depth report(s) tailored to the target audience (e.g., PrivacyImpact Assessment Report, briefing notes for senior management) that analysesexisting and proposed policies, programs and technical upgrades for gaps, risksand impacts on an individual’s personal information and privacy controls.Findings and recommendations for action are identified for business owners toconsider and action.

- Provides consultative advice, guidance and approaches onlaws, regulations, policies, standards, or procedures to clusters &ministries;, management, personnel, or key groups. May involve work with otherjurisdictions and the broader public sector.

General Skills

- Excellent knowledge of privacy and security concepts,trends, and issues. This includes an understanding of their impact on businessprocesses, as well as ability to interpret,



apply and communicate applicableprinciples and compliance requirements.

- Knowledge of, and experience in researching and applyingrelevant information privacy and access laws, regulations, jurisprudence(particularly as it relates to the Information and Privacy Commissioner ofOntario) and risk countermeasures and mitigation strategies

- Experience conducting privacy assessments involving personalinformation in a public sector context

- Knowledge of, and experience with mapping data flows andproviding advice on privacy approaches, privacy enhancing best practices andpotential mitigation strategies for consideration by business owners andclients.

- Knowledge and ability to interpret and apply Ontario’sFreedom of Information and Protection of Privacy Act (FIPPA) and its municipalequivalent the Municipal Freedom of Information and Protection of Privacy Act(MFIPPA), Personal Health Information Protection Act (PHIPA) their respectiveregulations and related jurisprudence

- Familiarity with federal Personal Information Protection andElectronic Documents Act (PIPEDA) and US PATRIOT Act, plus any other laws andregulations as applicable

- Policy Knowledge

- Familiarity with OPS Privacy Impact Assessment Process andTools released by the Ontario Ministry of Government Services;

- Familiarity with OPS Corporate Policy on RecordkeepingAccess and Privacy





- Good understanding of related disciplines, such as ITsecurity, IT system design, policy development (privacy or security), businessand security architecture, encryption methods, legal processes, Freedom ofInformation administration, business analysis, risk management, projectmanagement.

- Operational Program and Business Design Skills

- Ability to lead, mange or support the development of a PIAeither independently or as part of a team by consulting, negotiating andmediating across diverse subject matter expert groups (e.g., technical,business, legal, security, accessibility) within the organization to gather andcoordinate inputs and feedbacks.

- Knowledge and ability to create and understand data flowdiagrams and business process diagrams

- Ability to recognize the need for, and seek input fromexternal experts as required

- Excellent communication skills with technical and businessaudiences and non-technical access and privacy experts

- Technology and Systems Knowledge

- Analytical skills to understand the current and futureaccess and privacy implications of policies, decisions, business initiativesand industry trends

- Analytical skills to understand how data moves betweensystems and where personal information is exposed or stored

- Knowledge of Information Technology concepts and processesthat impact the protection of personal information, including (but not limitedto) Internet tools, system interfaces, encryption standards and methods,information security, information architecture and data flows.

- The work may span across legacy systems, digital and backendsystems, web applications, cloud-based solutions

📌 11917 (Toronto)
🏢 Maarut
📍 Toronto