Access and Privacy Specialist

Reporting to the Director, Risk, Privacy & Compliance, the Access & Privacy Specialist is responsible for supporting enterprise-wide compliance and operational alignment with Manitoba’s Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Health Information Act (PHIA) within a Crown corporation environment.

Operating within a highly regulated, publicly accountable organization, the Specialist ensures that access to information and privacy practices are consistent, defensible, citizen-focused, and aligned with statutory obligations, corporate policy, and public sector expectations for transparency and trust.

The role provides advisory services, coordinates access requests, supports privacy risk management, and works collaboratively across business units to embed compliant practices into programs, services, and technology initiatives.

• Coordinate, prepare, and respond to all requests, forms, and Requests for Access under FIPPA and PHIA, acting as the main point of contact for external and internal stakeholders.
• Serve as the first point of contact to the public and an access and privacy resource for all MPI areas, coordinating and monitoring the assembly and review of material relevant to formal responses to all Request for Access under FIPPA and PHIA.
• Coordinate with applicable departments for the assembly of records and required documentation.
• Review records and documentation to determine accessibility under the legislation, applying statutory exemptions and severing where appropriate.
• Document the application of exemptions as required.
• Determine whether an application should be transferred to another public body and, if so, arrange the transfer.
• Monitor the progress of the response process and provide formal responses within legislated time frames.
• Determine whether an extension of time is required to respond and, if so, arrange the extension.
• Prepare estimates of costs as required.
• Communicate with the applicant or affected third parties regarding the scope and nature of the inquiry, timing, and any follow-up required.
• Receive, investigate, track, and respond to “refusal of access” and privacy complaints lodged with the Manitoba Ombudsman under both FIPPA and PHIA.
• Ensure the implementation of any remedial action recommended by the Ombudsman resulting from a complaint.
• Prepare quarterly and annual summary reports for senior management on access and information request volumes, metrics, and trends.
• Coordinate, assist, or respond to other information requests for records received directly or by other business areas.
• Investigate and coordinate responses to reports and allegations of privacy breaches under FIPPA and PHIA, making recommendations for immediate and long‑term corrective measures.
• Develop, maintain, and provide privacy training to employees and other MPI community members.
• Coordinate privacy impact assessments (PIAs) as required and provide advice on initial and periodic privacy risk assessments of information handling practices, conducting related ongoing compliance monitoring activities.
• Draft policies and procedural changes governing various access and privacy issues.
• Work with Information & Technology to align information handling and privacy practices with current and emerging processing and security technologies.
• Work with legal counsel, management, key departments, and committees to ensure MPI has available, and routinely uses, customer consent and authorization forms complying with relevant legislation.
• Ensure MPI provides readily accessible notices and information to the public regarding its privacy and information handling policies and practices.
• Work with MPI’s legal counsel to ensure all contractual arrangements between MPI and third parties comply with statutory requirements regarding privacy processes and responsibilities.
• Assist in drafting Memoranda of Understanding as part of contractual arrangements and participate in ongoing compliance and monitoring of these arrangements.
• Work with Human Resources and other business units to ensure compliance with information handling and privacy practices throughout MPI, and to ensure consistent application of…