Compliance & Privacy Officer

Compliance & Privacy Officer
POSITION: UP TO FULL-TIME (ONE YEAR MATERNITY LEAVE REPLACEMENT)
REPORTS TO: DIRECTOR, ACCOUNTABILITY & IMPACT

Praxis Spinal Cord Institute is a Canadian-based not-for-profit organization that leads global collaboration in spinal cord injury research, innovation and care. We advance ground-breaking ideas that can be put into practice, making lives better. We actively engage people with spinal cord injury and other world-class experts to work together to identify and solve the most urgent challenges to make exceptional improvements in the health of people with spinal cord injury.  Praxis is proudly accredited by Imagine Canada and was named one of Canada’s Top 100 Charities by Maclean’s and Money Sense magazines, achieving an A+ rating.

Through a diverse workforce, Praxis is committed to excellence in research, innovation and care for people living with spinal cord injury. Praxis recognizes that a diverse workforce, comprised of individuals with an array of identities, abilities, backgrounds, cultures, skills, perspectives and experiences is vital to creativity, growth and innovation and our success in making an impact on quality of life. We support our commitment by fostering an inclusive workplace which is fair, equitable, supportive, welcoming and respectful, allowing us to continue to transform health outcomes.

JOB SUMMARY

The Compliance & Privacy Officer advises the organization on compliance, privacy, and governance matters and ensures that Praxis’ business practices are related to general organizational compliance and quality align with legislative, regulatory and contractual requirements, recognized standards and best practices.

This position is responsible for fostering a culture of compliance with the support of management and working with all employees to ensure overall compliance and quality. It is also responsible for following up on all findings and corrective and preventative action items as required and works with external parties in any compliance reviews or investigations as necessary.

The Compliance & Privacy Officer is required to stay up to date with both internal and external changes in business activities, technology, legislative, regulatory and contractual requirements, and best practices to ensure organizational adaptation and compliance, and to provide updates and escalate critical issues/concerns, as required.

JOB ACCOUNTABILITIES 

COMPLIANCE

• Developing, maintaining, and monitoring organizational compliance and quality management programs to strengthen governance and regulatory compliance;
• Developing, implementing, monitoring, and optimizing organizational policies, procedures and compliance frameworks to improve regulatory compliance and operational effectiveness, including processes regarding the management of policies, SOPs and forms, documentation of training, information security (non-technical), conflicts of interest, whistleblowing, intellectual property, Canadian Anti-Spam Legislation (CASL), policy and procedure deviations, complaints, and Board of Directors and business unit policies;
• Developing and delivering compliance training and awareness programs for all employees;
• Advising process owners on compliance risks and regulatory requirements, evaluating existing processes and recommending practical improvements to business practices and internal controls;
• Providing strategic support to management and business units on contractual and regulatory requirements, reviewing contracts and agreements, drafting, reviewing and updating templates, identifying compliance risks, and recommending appropriate revisions where required;
• Supporting organizational AI governance by assessing regulatory and compliance risks and recommending governance frameworks, policies and controls for the responsible use of artificial intelligence;
• Monitoring compliance with Imagine Canada’s Standards Program, and writing and submitting reports annually in order to maintain accreditation;
• Providing compliance and risk management advice, at the direction of the Director of Accountability & Impact and in collaboration with other internal stakeholders, to support organizational initiatives and strengthen enterprise risk mitigation across business functions;
• Conducting organizational compliance reviews and risk assessments of Praxis’ critical business activities and recommending corrective and preventive measures; and
• Liaising with external legal counsel regarding regulatory compliance, contractual matters and legal risk management, as required.

PRIVACY

• Maintains a privacy management program that is accountable and abides by Canadian federal, provincial and territorial legislation and regulations, international standards and best practices to ensure compliance with:
  • Privacy legislation for all jurisdictions within which Praxis currently operates and could possibly operate in the future; and
  • Praxis’ contractual requirements.
• Advising management and business units on privacy governance, regulatory obligations and privacy risk management to support informed business decisions and organizational compliance;
• Evaluating the effectiveness of the privacy management program, assessing privacy risks, recommending control enhancements and supporting continuous program improvements as necessary, including but not limited to:
  • Developing, implementing, maintaining and periodically reviewing privacy policies and related Standard Operating Procedures (SOPs);
  • Embedding Privacy by Design principles into organizational projects, policies, systems, and business processes;
  • Advising on regulatory requirements related to the collection, use, disclosure, retention and destruction of personal information, and recommending appropriate privacy controls;
  • Developing and delivering privacy awareness and training programs to support organization-wide compliance with privacy requirements
  • Developing, updating and reviewing Data Sharing Agreements, Data Processing Agreements, privacy schedules, confidentiality agreements, consent forms and consent language (or similar);
  • Managing privacy breaches, inquiries, and complaints;
  • Performing internal privacy reviews/audits, coordinating and following up on external audits and inspections;
  • Providing privacy governance updates to the Board of Directors, as required;
  • Conducting and coordinating privacy impact assessments (PIAs), third-party risk assessments and other compliance risk assessments, and advising management on mitigation strategies; and
  • Developing and maintaining personal informational inventory and data retention requirements to support compliance with applicable privacy legislation.

QUALIFICATIONS

Education: Undergraduate degree in a relevant area of study

Certification/Designation

• Formal training and/or certification in privacy is desirable (such as applicable IAPP certification)
• Formal training and/or certification in business compliance, contract law, quality assurance an asset

Experience

• At least 3 years of compliance, governance, risk management, policy development, and quality improvement experience in a complex organizational environment
• Experience with information security governance, including data protection policies, agreements and related organizational controls
• Experience managing privacy issues related to research data, data de-identification, and data access requests
• Experience in contracts management and contract review

Skills/Behaviours

• Strong organizational and adaptability skills to manage a diverse workload and multiple projects at the same time and keep track of multiple and varying regulatory and contractual obligations, with minimum supervision
• Strong analytical, problem-solving and critical thinking skills, as well as high attention to detail
• Superior technical writing skills and proficiency with MS Word, Excel, and PowerPoint
• Training and presentation skills an asset

An equivalent combination of education, experience and skills/behaviors will be considered.