Privacy Impact Assessment; PIA Specialist

Position: Privacy Impact Assessment (PIA) Specialist
Role:
Privacy Impact Assessment (PIA) Specialist

Location:

Toronto, ON Onsite (5 days a week, Monday–Friday, 8:00 a.m.–5:00 p.m.)

Must Have Skills
Experienced in privacy legislation including:
Freedom of Information and Protection of Privacy Act (FIPPA)
Personal Health Information Protection Act (PHIPA)
Personal Information Protection and Electronic Documents Act (PIPEDA)
Demonstrated experience conducting privacy assessments involving personal information, with examples cited in resume.
Proven ability to lead and conduct privacy assessments for online and/or digital solutions.
Experience conducting assessments involving personal health information with third-party solutions (e.g., private sector or non-profit applications, service integration providers).

Nice to Have Skills
Prior experience in broader public sector environments.
Professional certifications in IT security, privacy, or architecture.
Experience providing privacy-related education and training.

Responsibilities
Lead or support the development of Privacy Impact Assessments (PIAs) to evaluate whether new technologies, information systems, or proposed programs/policies meet legal and policy privacy requirements.
Identify and mitigate risks while addressing client concerns.
Ensure compliance with provincial, municipal, federal, and private sector access and privacy legislation, as well as relevant regulations, statutes, directives, standards, and internationally accepted Fair Information Practices.
Collaborate with policy development teams, IT security, system design, and business architecture groups to ensure privacy protections are embedded in solutions.
Create and interpret data flow diagrams and business process diagrams to support assessments.
Communicate findings clearly to technical and non-technical audiences, including senior executives.

Evaluation Criteria
1. Privacy Assessment Experience, Policy & Legislative Requirements (40%)
Expertise in FIPPA, PHIPA, PIPEDA.
Experience conducting privacy assessments involving personal information.
Leading assessments for online/digital solutions and personal health information with third-party providers.
Collaboration with policy teams to review and compare legislation, making informed recommendations.

2. Technical Understanding (30%)

Experience with privacy risks and PIAs across platforms.
Familiarity with security, encryption, and privacy protection approaches for digital solutions.

Experience with PIAs involving legacy systems, web applications, digital/cloud-based solutions.
Knowledge of cloud technologies and privacy best practices.
Understanding of privacy protection standards, business/information/security architecture principles, and emerging technologies.

3. Leadership & Communications (20%)
Strong communication and engagement skills to lead discovery sessions.
Ability to interpret technical and non-technical documentation to assess impacts and develop mitigation strategies.
Organizational and time management skills to handle multiple concurrent requests.
Presentation skills to communicate findings and recommendations to senior management.

4. Digital Identity Frameworks & Standards (5%)
Experience developing, applying, or evaluating digital identity trust frameworks.

5. Public Sector Experience (5%)
Prior experience conducting multiple PIAs in Public sector settings, with knowledge of Public sector processes, templates, and approval requirements.