Privacy Specialist

Objective

On behalf of our client withing the Federal Government we are recruiting for the services of a Privacy Impact Assessment Specialist in order to conduct privacy impact assessment(s) (PIAs) of the operational conduct, the data holding processes, and the software tools currently used and being considered, for FP Cybercrime as per its mandate and operational viability. The contract will ensure the completion and submission of a "program level" PIA.

Scope

Our client requires the services of a Privacy Impact Assessment Specialist to conduct PIAs of data holdings and software tools. The contract will ensure the completion and submission of a "program level" PIA.

The new PIA must assess the privacy risks of data holdings, potential data holdings, and cyber tools, including the provision of guidance and advice with respect to modifying policy and procedures involving privacy considerations and any impact on the PIA.

Tasks

The proposed resource must:

• Review and analyze government directives that may be applicable to the new PIA in order to meet current Government of Canada (GoC) standards and policies. The government directives may include Treasury Board Secretariat Privacy Impact Assessment Policy and Guidelines; Federal Privacy Act and Regulations; Treasury Board Secretariat Privacy and Data Protection Policy; Personal Information Protection and Electronic Documents Act; relevant GoC IT/IM policies and guidelines; Government On-Line initiatives; Secure Channel Network including its technical and business processes and service offerings; GoC IT Security practices and principles; and, GoC IT Security technological solutions.
• Complete a new, comprehensive PIA for the client including privacy impact assessment/analysis of current data holdings, anticipated data holdings and analytical tools that the program requires to fulfill its mandate. This must be done in accordance with the requirements of Treasury Board Secretariat Privacy Impact Assessment Policy; Treasury Board Privacy Impact Assessment Policy Guidelines; and, other GoC relevant standards, procedures and guidelines.
• While conducting the PIA, liaise where appropriate with key stakeholders and partners
• At the request of the Project Authority, participate in meetings held with stakeholders as required to complete the PIA.
• Review and provide recommendations for the collection, administration, retention and disposal of personal information as appropriate.

• Review existing information sharing agreements and memoranda of understanding with partner agencies and provide recommendations on their applicability to operations as they may relate to privacy assessment considerations.

• Develop a Privacy Risk Management Plan to analyze, track, control, and mitigate the privacy risks identified in the new PIA. The plan must include recommendations with respect to privacy risk mitigation strategies, including training specific to employees with respect to the administration and safeguarding of personal information.

Provide other ad-hoc support as required by the Project Authority. This may include but is not limited to the following:

1. Assist in the development of operational policies,memoranda of understanding and/or information sharing arrangements with respect to any privacy assessment and personal information assessment considerations.
2. Assist in the development of ad-hoc reports and documentation as it pertains to the privacy and security of personal information noted in the PIA, such as assisting with Security Assessment & Authorization, Statement of Sensitivity, and/or Interim Authority to Operate activities
3. Review data acquisition initiatives and any other IM/IT capabilities to ensure conformance to the Treasury Board Secretariat guidelines and policies.

Skills/Experience Required:

Mandatory Requirements

• minimum of ten (10) years of combined experience in conducting reviews

Responsibilities could include but are not limited to

• Reviewing,analyzing, and/or applying:
• Treasury Board Privacy Impact Assessment Policy and Guidelines
• Federal Privacy Act and Regulations
• Treasury Board Privacy and Data Protection Policy
• Personal Information Protection and Electronic Documents Act (PIPEDA)
• GC IT/IM policies and guidelines
• Government On-Line (GOL) initiatives
• Secure Channel Network including its technical and business processes and service offerings
• IT Security practices and principles
• IT Security technological solutions
• Conducting privacy impact assessments (PIAs) and preliminary privacy impact assessments (PPIAs) of projects and concepts, in accordance with the requirements of:
• Treasury Board Privacy Impact Assessment Policy

• Treasury Board Privacy Impact Assessment Policy Guidelines

• Other relevant standards, procedures and guidelines

• Analyzing the flow of information using the PIA model provided by the client

• Conducting privacy analysis to provide evidence of compliance with privacy principles and to identify privacy risks
• Completing tasks directly supporting the departmental IT Security and Cyber Protection Program

• Develop and deliver training material relevant to the resource category

• 5 years of experience Developing a Privacy Risk Management Plan to analyze, track, control, and mitigate the privacy risks identified in the new PIA. The plan must include recommendations with respect to privacy risk mitigation strategies, including training specific to employees with respect to the administration and safeguarding of personal information.

• Certified Information Privacy Professional (CIPP)

Rated Requirements

• 5 years' experience within the last 10 years leading or writing an approved Privacy Impact Assessment (PIA) in the Government of Canada
• 5 years' experience within the last 10 years conducting a PIA on a solution implementation initiative for public-sector clients (i.e., federal, provincial, or municipal governments), involving IM/IT systems requiring multiple implementation phases
• 5 years' experience within the last 10 years in reviewing and assessing Information Sharing Agreements
• 5 years' experience within last 10 years in reviewing and assessing Privacy requirements associated with third party service contracts
• 5 years' experience within the last 10 years in reviewing or developing System user access and notice and consent statements
• 5 years' experience within the last 10 years in developing Design of privacy training
• 5 years' experience within the last 10 years in reviewing, amending, or developing Privacy breach protocol