Senior Privacy Impact Assessment (PIA) Specialist — FIPPA / MFIPPA / PHIPA

Required Skills & Experience

• Senior-level PIA leadership: Proven experience leading or supporting end-to-end Privacy Impact Assessments for new technologies, information systems, programs, or policies — including scoping, risk identification, mitigation planning, and final assessment reporting.
• Ontario privacy legislation: Strong working knowledge of Ontario's Freedom of Information and Protection of Privacy Act (FIPPA), Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), and Personal Health Information Protection Act (PHIPA), including their regulations.
• IPC Ontario expertise: Demonstrated ability to research and apply Information and Privacy Commissioner of Ontario (IPC) decisions, orders, and jurisprudence to real assessment work.
• OPS PIA Process and Tools: Familiarity with the Ontario Public Service Privacy Impact Assessment Process and Tools released by the Ontario Ministry of Government Services (formerly MGCS/MGS).
• Broader privacy law awareness: Working knowledge of PIPEDA and related federal/provincial privacy requirements, Management Board of Cabinet Directives, and internationally recognized Fair Information Practices.
• Privacy risk and mitigation: Ability to assess privacy risks, design mitigation and risk countermeasures, and maintain risk registers and remediation tracking across multiple concurrent projects.
• IT and data-flow literacy: Ability to read and create data flow diagrams and business process diagrams, and understand system interfaces, information architecture, cloud services, APIs, and IT security concepts that affect personal information.
• Stakeholder advisory and leadership: Experience advising ministries, clusters, IT clients, and senior management; leading cross-functional or cross-cluster working groups; and communicating complex privacy issues clearly to technical and non-technical audiences.
• PIA program operations: Experience managing a PIA intake queue, workload and resource allocation, and tracking assessment progress to optimize delivery.
• Policy, training, and records knowledge: Experience developing privacy policies and procedures, delivering privacy training and awareness, and applying records management, retention, and disposition requirements; familiarity with AODA is an asset.