Vice President, Head of Privacy (Privacy, Cyber Security, Consumer Compliance)

The New York Times•New York, NY

76d•$275,000 - $315,000•Hybrid

About The Position

The Vice President, Head of Privacy is responsible for all legal aspects of data privacy, information security, and consumer marketing and subscriptions-related compliance across the company. This role manages the Company's privacy compliance function and works closely with senior executives and operational leads in various departments including marketing, product, engineering, data governance, information security, and commercial contracts. The position involves managing a team and is a hybrid role based in the New York City headquarters, requiring approximately 3 days per week in the office.

Requirements

Juris Doctor is required and must be a member of the New York Bar.
15+ years of experience in US and international data privacy and protection; negotiating data privacy-related agreements, building, implementing, and maintaining a global privacy program; supporting cybersecurity.
5+ years of experience managing people with proven experience effectively managing cross-functional relationships and competing priorities.
5+ years of previous in-house experience.
Experience advising on online safety laws such as age-appropriate design codes and app store age signals laws, and sensitive data privacy regulations such as laws governing health data in ad tech and biometric privacy.
Experience advising or managing legal professionals who advise on a wide variety of consumer-related issues both domestic and international, including payflow, subscription offerings, marketing, auto-renewal and click-to-cancel laws, anti-spam, Telephone Consumer Protection Act, unfair and deceptive practice laws, customer care complaints and escalations, and payment card rules.
Excellent judgment and professional integrity.

Nice To Haves

5+ years in-house experience at a tech platform, media company, and/or subscription-first company.

Responsibilities

Advise internal clients on risks and operational controls related to the development, collection, use, transfer, and governance of personal data of consumers, employees, and other stakeholders, including privacy, online safety, and cybersecurity from U.S. and international perspectives.
Advise key business stakeholders on the company’s data governance, cybersecurity, marketing and subscriptions compliance efforts.
Drive measurable improvements in privacy program maturity, incident readiness, vendor governance, compliant product launches, and privacy risk reduction.
Manage privacy program resourcing, vendor support, and outside counsel engagement for privacy matters.
Draft and/or update privacy program-related policies and standards, public-facing and internal; as well as terms of use, terms of sale, and other consumer-facing acceptable use and moderation policies.
Supervise and oversee the preparation and updating of Data Protection Impact Assessments and other risk assessment and audit activities.
Conduct comprehensive business risk assessments; develop/implement risk mitigation and corrective action plans.
Advise on privacy regulatory and contractual compliance in marketing, ad sales, direct and programmatic advertising, identity resolution, data clean rooms, and third-party data and ad tech integrations.
Review, draft and negotiate data protection agreements and security exhibits and advise on third party risk reviews.
Advise on all relevant consumer protection, subscriptions and marketing laws, regulations and best practices.
Provide product counseling including privacy, cybersecurity and consumer compliance legal advice in connection with product and platform developments and releases.
Regularly track and counsel clients on legal US and international developments in data privacy, cybersecurity and consumer marketing and subscription compliance.
Serve as legal lead for all security incident response, working closely with the company’s Chief Information Security Officer and other key stakeholders.
Draft and update information security policies and procedures.
Provide advice and guidance to data science and analytics teams on privacy-compliant deployment of machine learning models and personalization.
Oversee and develop company-wide training strategy and execution for areas of coverage.
Serve as point of contact for data protection authorities, regulatory inquiries, and industry groups.
Handle high-volume workload efficiently.
Demonstrate support and understanding of journalistic independence and a strong commitment to the company's mission.