Privacy Attorney

The Kroger Co.•Cincinnati, OH

About The Position

The Privacy Attorney provides legal review and guidance on initiatives affecting privacy, data protection, and security. The attorney partners across the company to advise on data uses and privacy strategies, manage legal risk, and ensure regulatory compliance. The role also provides privacy and data security expertise to other attorneys negotiating commercial deals involving personal information. The attorney is expected to demonstrate the company’s core values of respect, honesty, integrity, diversity, inclusion, and safety. The position supports the company’s privacy program through legal advice, regulatory monitoring, customer and regulatory responses, privacy notices and internal policies, risk assessments, contract reviews, employee training, compliance monitoring, and incident response. It requires collaboration with legal colleagues and teams across information security, procurement, product development, engineering, and data governance.

Requirements

Juris Doctor or another law degree from an accredited U.S. law school and active membership in at least one state bar.
At least 2 years of experience providing pragmatic, actionable advice on legal risks and obligations under U.S. or European privacy and data security laws, including GDPR.
At least 5 years of combined experience in law firms, governmental agencies, and/or in-house legal departments.
Experience developing and implementing external privacy notices.
Ability to build and manage a network of key stakeholder relationships.
Strong ethical compass and problem-solving skills.
Strong analytical, strategic-thinking, and communication skills, with demonstrated legal and business judgment.
Ability to work with large, multi-stakeholder teams.
Ability to work with IT professionals and knowledge of basic IT terms and concepts.
Ability to translate legal advice into actionable guidance for product, engineering, security, and business teams.
Prior experience advising on policies and procedures concerning data use, security, and privacy.

Nice To Haves

Experience advising on privacy and data security in commercial transactions.
Bachelor’s degree in IT, Data Analytics, or Cybersecurity.

Responsibilities

Ensure the company complies with applicable privacy and data security laws, rules, and regulations.
Provide expertise and guidance to legal colleagues, Corporate Information Security, Procurement/Sourcing, product development, and engineering teams.
Identify and communicate applicable existing and new legal and regulatory requirements, including changes, on an ongoing and timely basis.
Draft responses to privacy- and security-related customer, associate, and regulatory inquiries and investigations.
Draft external privacy notices and disclosures, and manage and update internal policies and procedures to ensure compliance with privacy and cybersecurity laws.
Help enhance, scale, and operate the privacy program, including privacy operations and documentation, employee training, policy enforcement, monitoring and auditing, and incident response.
Work with Data Sharing Governance, Compliance, CIS, and others to scope and perform privacy risk assessments and contract reviews, and to plan mitigation, remediation, data control design, and monitoring.
Stay current on relevant consumer protection, privacy, and data security laws and regulations, technological developments, threat vectors, and evolving industry standards.
Interact with others in a professional, tactful, and sensitive manner.
Perform the essential job functions with or without reasonable accommodation.