Legal and Privacy Manager

Heart & Stroke

4d • Remote

About The Position

This is an exciting opportunity to bring your legal, privacy and risk expertise to mission-driven work that makes a difference in the lives of people across Canada. Heart & Stroke offers a flexible remote work environment with the ability to work from anywhere in Canada. From time to time, occasional travel to the Toronto office may be required as well as responsiveness outside regular business hours to support time-sensitive matters, such as privacy incidents. This role partners with business units to advance mission-driven work by providing practical legal, privacy and compliance guidance that balances operational needs, stakeholder experience, donor trust, regulatory obligations and organizational risk tolerance to support risk-informed decisions. More specifically, this role manages the day-to-day operations of the privacy program, supports contract review and negotiation, and helps maintain the enterprise risk management program. Working under the direction of the Legal Counsel & Director, Risk Management, this role also provides operational execution and advisory support, escalating complex or high-risk matters as appropriate. The role also works with external stakeholders, including regulatory bodies and third-party service providers, to support compliance and risk mitigation.

Requirements

• Education Law Degree (LL.B. or J.D.)
• Called to the Ontario Bar Association and Member in good standing with the Law Society of Ontario
• 2-4 years professional experience in a firm, private practice, or in-house environment
• Experience in one or more of the following areas: Privacy and data protection (e.g., PIPEDA, CASL; Quebec Law 25)
• Commercial contracting
• In-house or advisory roles supporting business stakeholders
• Critical and analytical thinking is essential
• Excellent written and verbal communication skills
• Ability to influence and communicate effectively internally and externally at all levels;
• Ability to balance and address both business and legal considerations
• Positive, team player; motivated and proactive
• Strong analytical, drafting, influencing and negotiation skills
• Capable of multi-tasking and managing multiple projects by being flexible, organized and able to prioritize many projects at once and manage own workload independently
• Strong decision-making / problem solving ability while remaining client focused and solution oriented.
• Competency in Microsoft Word, Excel, Power Point and virtual technologies for communication (ie -MS Teams)

Nice To Haves

• Experience with enterprise risk management framework and processes

Responsibilities

• Manage and maintain a national privacy portfolio.
• Manage a consolidated database of where, how and why personal information collected, used, stored, retained and destructed (where applicable).
• Manage, oversee, implement and maintain a national retention policy
• Maintain and update a public facing national privacy policy and terms of use and monitor its ongoing implementation
• Maintain and update internal privacy policies
• Oversee internal privacy procedures; identify the necessary procedures and delegate to the appropriate business units.
• Monitor and negotiate agreements with third parties that host, collect, use, or have any other relationship with HSFC collected personal information
• Manage privacy inquiries and complaints, including escalation and reporting, both internal and external where required
• Oversee the maintenance of suppression lists of people that don’t want to be contacted
• Track and monitor all privacy complaints; collect analytics to track progress over time
• Support the management of privacy breaches, including ensuring compliance with reporting requirements and communicating with affected individuals, both internal and external, as necessary.
• Review digital and print materials prior to publishing for compliance with privacy legislation and CASL
• Conduct privacy reviews of digital initiatives, platforms and third-party engagements
• Deliver training sessions and refreshers as necessary on privacy procedures
• Advise nationally on privacy issues
• Monitor and stay abreast of any new developments in legislation, guidelines and industry standards
• Support enterprise risk management processes
• Support the maintenance of the enterprise risk management framework
• Maintain the enterprise risk management risk registrar
• Support the coordination of the annual and quarterly enterprise risk management cycle
• Support business units in identifying and documenting operational and regulatory risks
• Track and monitor mitigation actions and contribute to reporting requirements and trend analysis
• Promote awareness of risk management practices across the organization
• Support contract review and provide legal advice to business units
• Review, draft and negotiate low to medium complexity contracts
• Engage with business early in the process to provide strategic advice and guide negotiations and terms prior to contract drafting
• Provide guidance and insight to business units on legal obligations and responsibilities and lead contract reviews in a timely fashion
• Negotiate with third parties on behalf of the Foundation to represent its interests
• Provide practical, business-oriented legal advice on contractual obligations and risk mitigation to ensure H&S interests are protected
• Partner with business units to provide practical, solution oriented legal and contract risk support that creatively still enables organizational objectives while helping to identify and assess enterprise and reputational risk
• Continuously evaluate and improve training materials, processes, and delivery methods to enhance the efficiency, quality, and consistency of review activities across the organization.
• Escalate complex or high-risk matters to the Director as appropriate
• Provide regulatory compliance support and legal research
• Advise stakeholders on regulatory developments and provide business appropriate and practical solutions
• Conduct legal research and prepare summaries on relevant laws, regulations and guidance
• Support responses to regulatory inquiries, complaints and investigations
• Support corporate and legal operations
• Oversee annual renewal of all insurance policies for the Foundation, including D&O insurance, through working with the Foundation’s broker
• Draft updates for the Board and make recommendations on insurance coverage
• Negotiate and review contracts to ensure appropriate insurance coverage
• Liaise with broker as needed to update the policies
• Lead process of claims as necessary
• Assist with corporate filings and regulatory compliance tracking

Benefits

• flexible remote work environment
• competitive health, medical, dental and vision benefits
• life insurance
• disability benefits
• an employee assistance program (EAP)
• a defined contribution pension plan with employer matching
• flexible hybrid working model
• reimbursement for mobile phones and home office setup
• opportunities for professional development
• generous paid time-off package including vacation days, personal days, wellness days, and paid company-wide closure between December 25 and January 1

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level