Access and Privacy Specialist

Overview
Reporting to the Director, Risk, Privacy & Compliance, the Access & Privacy Specialist is responsible for supporting enterprise-wide compliance and operational alignment with Manitoba's Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Health Information Act (PHIA) within a Crown corporation environment.

Operating within a highly regulated, publicly accountable organization, the Specialist ensures that access to information and privacy practices are consistent, defensible, citizen-focused, and aligned with statutory obligations, corporate policy, and public sector expectations for transparency and trust.

The role provides advisory services, coordinates access requests, supports privacy risk management, and works collaboratively across business units to embed compliant practices into programs, services, and technology initiatives

Responsibilities

Responsible for coordinating, preparing, and responding to all requests, forms, and Requests for Access under FIPPA and PHIA, and acts as a main point of contact for external and internal contacts.

Serves as a first point of contact to the public and an access and privacy resource to all areas within Manitoba Public Insurance (MPI) by coordinating and monitoring the assembly and review of material relevant to formal responses to all Request for Access under FIPPA and requests for access under PHIA, including:

Coordinating with applicable departments for the assembly of records and required documentation

Reviewing records and documentation and determining whether the records sought are accessible under the legislation, whether any of the statutory exemptions to disclosure apply, and whether any records can be released with severing.

Documenting the application of exemptions (as required).

Determining whether an application should be transferred to another public body and, if so, arranging the transfer

Monitoring the progress of the response process and providing a formal response within the legislated time frames

Determining whether an extension of time is required to respond and, if so, arranging the extension

Preparing estimates of costs as required

Communicating with the applicant or affected third parties regarding the scope and nature of the inquiry, timing, and any follow-up required.

Receives, investigates, tracks, and responds in a timely fashion to "refusal of access" and privacy complaints lodged with the Manitoba Ombudsman under both FIPPA and PHIA.

Ensures the implementation of any remedial action recommended by the Ombudsman as a result of a complaint.

Prepares quarterly and annual summary reports for senior management on access and information request volumes, metrics, and trends.

Coordinates, assists or responds to other information requests for records received directly or by other business areas.

Investigate and coordinate responses to reports and allegations of privacy breaches of personal information under FIPPA and personal health information under PHIA and make recommendations for immediate and long-term corrective measures as necessary to protect the confidentiality, integrity and security of all personal information and personal health information, as well as sensitive corporate and business information.

Develops, maintains, and provides privacy training to employees and other members of the MPI community.

Coordinates privacy impact assessments (PIAs) to be conducted as required and provides advice on initial and periodic privacy risk assessments of information handling practices and conducts related ongoing compliance monitoring activities.

Drafts policies and procedural changes governing various access and privacy issues.

Works with Information & Technology to align information handling and privacy practices with current and emerging processing and security technologies.

Works with legal counsel, management, key departments, and committees to ensure that MPI:

has available, and routinely uses, customer consent and authorization forms which comply with the relevant legislation

provides readily accessible notices and information to the public regarding its privacy and information handling policies and practices

Works with MPI's legal counsel to ensure that all contractual arrangements between MPI and third parties comply with the applicable statutory requirements regarding processes and responsibilities for ensuring and respecting privacy. As required, assists in drafting Memoranda of Understanding as part of the contractual arrangements and participates in the ongoing compliance and monitoring of these arrangements.

Works with Human Resources and other business units to ensure compliance with information handling and privacy practices throughout MPI, and to ensure the consistent application of sanctions for failure to comply with those practices