Privacy Attorney

Kroger•Cincinnati, OH

About The Position

Provide legal review and guidance on initiatives affecting privacy, data protection, and security. Partner cross-functionally to inform, influence, and advise on data uses and privacy strategies while managing legal risk and ensuring regulatory compliance. Serve as a privacy and data security subject matter expert for other attorneys negotiating commercial deals involving personal information. Demonstrate the company's core values of respect, honesty, integrity, diversity, inclusion, and safety. The role supports compliance with privacy and data security laws and regulations, advises legal and business teams, and helps enhance and operate the company's privacy program. This includes privacy operations and documentation, employee training, policy enforcement and monitoring, auditing, risk assessments, contract reviews, and incident response.

Requirements

Juris Doctor or another law degree from an accredited U.S. law school and active membership in at least one state bar.
At least 2 years of experience providing pragmatic, actionable advice on legal risks and obligations under privacy and data security laws in the U.S. or Europe, including GDPR.
At least 5 years of combined experience in law firms, governmental agencies, and/or in-house legal departments.
Experience developing and implementing external privacy notices.
Ability to build and manage a network of key stakeholder relationships.
Strong ethical compass and problem-solving skills.
Strong analytical, strategic-thinking, and communication skills, with demonstrated legal and business judgment.
Ability to work with large, multi-stakeholder teams.
Ability to work with IT professionals and knowledge of basic IT terms and concepts.
Ability to translate legal advice into actionable guidance for product, engineering, security, and business teams.
Prior experience advising on policies and procedures concerning data use, security, and privacy.

Nice To Haves

Experience advising on privacy and data security in commercial transactions.
Bachelor's degree in IT, Data Analytics, or Cybersecurity.

Responsibilities

Ensure the company complies with applicable laws, rules, and regulations related to privacy and data security.
Provide expertise and guidance to legal colleagues, Corporate Information Security, Procurement/Sourcing, product development, and engineering teams.
Identify and communicate existing and new legal and regulatory requirements applicable to Kroger, including changes on an ongoing and timely basis.
Draft responses to privacy- and security-related customer, associate, and regulatory inquiries and investigations.
Draft external privacy notices and disclosures, and manage and update internal policies and procedures to comply with privacy and cybersecurity laws.
Assist in enhancing, scaling, and operating the existing privacy program, including privacy operations and documentation, employee training, policy enforcement, monitoring and auditing, and incident response.
Work with Data Sharing Governance, Compliance, CIS, and others to scope and perform data privacy risk assessments, contract reviews, mitigation and remediation, including data control design and monitoring.
Remain current on consumer protection, privacy, and data security laws and regulations, technological developments, threat vectors, and evolving industry standards.
Interact with others in a professional, tactful, and sensitive manner.
Perform the essential job functions with or without reasonable accommodation.