Information Privacy Analyst

Overview

The incumbent represents the Mission and Values of Legal & Immigration Services (LIS). The Information Privacy Analyst is responsible for the management and analysis of sensitive data to ensure compliance with privacy and access regulations and guidelines. This role involves designing and implementing technical solutions for data privacy, conducting privacy audits, and collaborating with various departments to ensure the secure handling of personal and confidential information.

The Information Privacy Analyst will work closely with the Secretariat, Information Security Services team in IST, Institutional Analysis and Planning, and other stakeholders to uphold data protection principles within the organization.

Reporting directly to the Legal Counsel this position is accountable for risk identification and assessment for compliance of the University’s responsibilities under the provincially mandated Freedom of Information and Protection of Privacy Act (FIPPA). The Legal and Immigration Services team fulfills the University’s obligations under the federal Personal Information Protection and Electronic Documents Act (PIPEDA)

Responsibilities

Data Management and Governance

Offer guidance to the university community on information and privacy related legislation and organizational policies Ensure proper data access controls and usage guidelines align with privacy requirements Collaborate with Legal Counsel, Privacy, on the enhancement of processes to monitor, audit, and improve information and privacy practices Oversee the maintenance of up-to-date records of documents, including inquiries, incidents, and resolutions Accrue accurate and confidential data and statistics for reporting purposes Coordinate and develop reports for Legal Counsel, Privacy, and General Counsel to inform senior leadership of information and privacy related activities at the University Collaborate with Legal Counsel, Privacy, to provide strategic recommendations and development of policies and procedures related to information and privacy Liaise with government agencies and external professional colleagues, to remain up to date about changes to policies, regulations, and guidelines Perform environmental scans across industry to be well-informed of information and privacy trends Responsible for evaluating the effectiveness of information and privacy services at the University, providing recommendations for continuous improvement Maintain best practices for file and information management utilizing the electronic data management system. 

Privacy Policy and Procedure Development

Consult with Legal Counsel, Privacy, senior leadership, and relevant stakeholders to develop and update privacy policies, procedures, and guidelines in compliance with federal and provincial laws and regulations Collaborate with departments to identify and classify sensitive data, ensuring proper protection and retention. • Collaborate with cross-functional teams to identify and address data interdependencies that impact privacy compliance Develop and maintain strong relationships with departmental experts to understand their data usage while aligning with privacy guidelines Develop, test, and deploy technical solutions that support data anonymization, encryption, and secure data sharing Design and maintain data dashboards that provide insights into privacy compliance metrics Assess reporting tools that uphold privacy mandates and contribute to back-end architecture decisions Contribute to the development of advanced privacy analytics methodologies and tools Identify opportunities to leverage technology for enhanced privacy self-assessments and decision support Apply analytical skills to identify patterns and develop predictive models related to data breaches and privacy incident Promote a culture of continuous improvement in terms of efficiency and leveraging systems capacities and technologies

Privacy Audits and Compliance

Monitor the University’s compliance with relevant laws and regulations Conduct regular audits to identify and mitigate information and privacy risks Partner with departments to identify areas for improving data handling processes while ensuring compliance with access and privacy regulations Facilitate Privacy Impact Assessments and provide guidance in consultation with Legal Counsel, Privacy, to ensure University projects and processes consider and address privacy issues Address gaps and overlaps within data sets, proposing methods to enhance data collection and processing, ensuring data integrity and compliance are maintained Using knowledge of best practices, assist in the development of incident response procedures related to data breaches and or privacy incidents, facilitating communication with affect parties and regulatory bodies as required Participate in incident investigations and provide recommendations for corrective action.

Develop and Promote Information and Privacy Practices

Responsible for a University culture of privacy and information awareness in collaboration with other stakeholders Develop and maintain a communication and education strategy for academic and academic support units to promote and develop privacy protection Provide training on access and privacy, breach awareness, and privacy-promoting work habits Coach and train constituents on record-keeping obligations Design and execute privacy-related employee surveys to gauge awareness and concerns Analyze survey data to identify trends and potential issues, providing recommendations for improvement Liaise and consult with other post-secondary Legal and/or Privacy Offices to share access and privacy best practices

Qualifications

University degree in relevant field such as Information Management, Privacy, Legal Studies, Data Science, or related field, or equivalent combination of education and experience Relevant professional designation from the International Association of Privacy Professionals (IAPP) or other recognized professional body is an asset Minimum of 3 years of experience performing significant data analysis, privacy compliance, or work of a related field Familiarity with data governance and privacy regulations is highly preferred Knowledge of relevant data analysis tools and privacy compliance frameworks Project management experience in a complex environment Demonstrated experience using Microsoft PowerBI and/or Tableau Protection and Electronic Documents Act, the Freedom of Information and Protection of Privacy Act, and the Information and Privacy Commissioner of Ontario, including regulations and legislation Ability to understand university guidelines, policies, and practices. Familiarity with the University of Waterloo’s policies and guidelines an asset Understanding of access to information and privacy protection matters, and of related legislation and policy in a university or public sector setting Commitment to upholding the highest ethical standards and confidentiality Competent in providing guidance to others in solving complex situations affecting the University’s business Clear and critical thinking, with strong writing and reasoning skills, problem solving skills, and professional judgement Proficient in project management and business analysis Advanced data analysis skills, and experience with statistical modeling and predictive techniques Strong verbal and written communication skills to translate information into easily understood terms, summarizing, and presenting information to effectively educate and build awareness of information and privacy regulations Meticulous attention to detail when reviewing data and documents for compliance Ability to follow formal business practices with high attention to detail Advanced ability to build standardized reports of relevant data using real-time integrations and in enterprise-grade toolsets such as Microsoft PowerBI and/or Tableau Adapts readily and effectively to changing priorities and demands Highly competent in maintaining confidentiality and treat sensitive information with discretion Demonstrate a high level of professionalism, working effectively and efficiently with internal and external clients Effective influential and consultative skills with the ability to build strong interpersonal relationships Ability to adapt to evolving privacy laws and technologies affecting higher education Proven ability to work independently and resourcefully Driven by equitable, diverse, and inclusive practices

---