Senior Specialist, Privacy

University Pension Plan•Toronto, ON

61d•Hybrid

About The Position

Reporting to the Senior Legal Counsel, Technology, Privacy Officer, the Senior Specialist, Privacy will be instrumental in advancing UPP’s privacy compliance framework. This role is central to ensuring that UPP not only meets but exceeds the expectations of UPP’s member and prospective universities, reinforcing UPP’s value proposition as a fit-for-purpose pension solution for Ontario’s higher education sector. By aligning with our stakeholders’ standards and fostering trust, this role directly contributes to UPP’s long-term strategic success. In addition to stakeholder expectations, the Senior Specialist, Privacy will help ensure UPP meets—and where possible, exceeds—the regulatory baselines established by our regulator, the Financial Services Regulatory Authority of Ontario (“FSRA”), as well as the standards set out by the Office of the Privacy Commissioner of Canada (“OPC”), and the privacy principles outlined in FIPPA and by the Information and Privacy Commissioner of Ontario (“IPC”). This includes day-to-day monitoring of compliance, auditing, privacy training for UPP’s internal business partners, and ensuring legal authority for all personal information processing is well-documented and defensible. The ideal candidate is detail-oriented and thrives in a results-driven environment. They are a proactive “builder” who sees this role as an opportunity to take UPP’s privacy program to the next level and leave a meaningful mark. They are a self-starter with strong analytical and critical thinking skills, who brings curiosity, initiative, and a genuine interest in privacy and compliance. This is a role for someone who wants to build—and own—something that matters. This role is based in downtown Toronto in a hybrid work environment, allowing employees the flexibility to work remotely and in-office (minimum two days per week in-office). This posting is for an existing vacancy.

Requirements

Bachelor's degree in legal studies, Business, Computer Science, Public Policy or a degree with coursework in privacy, data protection, cybersecurity, or related field.
Minimum of 3 years of experience in a privacy, compliance, or data governance role.
Experience conducting PIAs, managing privacy training programs, and monitoring compliance with internal policies.
Familiarity with privacy legislation including PIPEDA, FIPPA, and emerging privacy frameworks.
Strong analytical and critical thinking skills.
Excellent communication and interpersonal abilities.
Comfortable working independently and collaboratively across departments.
Outstanding administrative and organization skills, detail-oriented, able to prioritize and multitask.
Demonstrated ability to meet high performance standards and maintain a calm, pleasant demeanor in a fast-paced, deadline-driven environment.
A proven track record of a proactive “ownership mindset” evident through responsibility and accountability.
Demonstrated initiative and interest in evolving privacy and compliance landscapes.
A highly professional video, telephone, and email presence.
Handles confidential information with discretion.

Nice To Haves

CIPP/C or other CIPP qualification is an asset.

Responsibilities

Privacy Compliance Monitoring & Auditing
Conduct day-to-day monitoring of privacy compliance across UPP, including PIPEDA or other applicable provincial legislation.
Conduct and/or facilitate periodic audits to assess adherence to UPP’s privacy policies, statements, and procedures.
Develop and maintain compliance dashboards to track key metrics.
AI Governance and Support
Support the execution of AI Impact Assessments under UPP’s Employee Use of AI Framework.
Assist in implementing and updating AI governance processes and controls aligned with emerging legislation.
Monitor AI regulatory developments and support organizational readiness and compliance.
Personal Information Management
Maintain and monitor the uses of all PI at UPP.
Track the legal authority for PI processing, ensuring it is sufficiently documented and robust.
Build and maintain a comprehensive PI data map across all of UPP’s operations (including third party vendors).
Policy Development & Implementation
Proactively monitor relevant legislative developments in privacy, both in Ontario and abroad.
Develop and update privacy policies and procedures in line with legislative requirements and best practices.
Ensure policies are effectively communicated and implemented across the organization.
Training & Awareness
Develop and deliver ongoing privacy training and awareness sessions to staff.
Promote a culture of privacy through ongoing engagement with employees.
Develop and maintain a privacy partner program to embed privacy considerations in UPP’s business operations.
Privacy Impact Assessments (PIAs)
Conduct and document PIAs for new projects, initiatives, or systems involving PI.
Proactively update PIAs as a “living document”.
Work collaboratively with departments to assess and mitigate privacy risks.
Incident Management
Assist in the management and investigation of privacy incidents and breaches.
Maintain a breach response protocol, breach log, and notification workflows.
Investigate privacy breaches at UPP to make recommendation on regulatory notifications to the General Counsel and Privacy Officer.
Regulatory Engagement
Serve as a liaison with privacy regulators and oversee compliance reporting.
Stay informed about changes in privacy legislation and ensure UPP's practices remain compliant.