Manager of Compliance - Privacy
American Express · Toronto, ON, Canada · hybrid
Reporting to the Director of Compliance Advisory & Deputy Privacy Officer, the Manager of Compliance - Privacy will play a key role in supporting Amex Bank of Canada's ("the Bank") Canadian privacy compliance and risk management program.
The Manager will support the Legal Entity Compliance Officer ("LECO") and Canadian Privacy Officer through Second Line of Defence ("2LOD") oversight, effective challenge and regulatory assessment of privacy and data protection matters affecting the Bank.
The role will have four primary areas of responsibility:
- Privacy and Data Breach Oversight - Provide 2LOD oversight and challenge of potential privacy and data breach cases affecting Canada, including assessment of incidents against applicable Canadian legal and regulatory requirements and recommendations regarding notification and regulatory self-reporting obligations.
- Privacy Access Request Oversight - Provide 2LOD oversight and challenge of First Line of Defence ("1LOD") execution of personal information access requests, including review of escalated or complex matters and assessment against applicable Canadian privacy requirements.
- Privacy Complaints and Regulatory Engagement - Review and support responses to escalated privacy complaints, including matters involving or referred to the Office of the Privacy Commissioner of Canada ("OPC"), and support the LECO/Privacy Officer in regulatory engagement and remediation arising from privacy complaints.
- Privacy Risk Assessments and Governance - Support and, where delegated, execute Canadian Privacy Officer responsibilities relating to Privacy Risk Assessments and other privacy risk governance activities, partnering closely with Global Privacy Oversight ("GPO"), International Privacy Risk Management ("IPRM"), Legal, business teams and other risk partners.
The Manager will serve as a key Canadian privacy compliance subject matter expert and will be expected to maintain a strong understanding of applicable Canadian privacy and data protection requirements, including PIPEDA and related regulatory guidance, as well as relevant internal American Express privacy policies, standards and procedures.
The role requires sound regulatory judgement, strong analytical and written communication skills, and the ability to provide credible and independent challenge to business and risk partners. The Manager will work closely with stakeholders across the Bank and the broader American Express organization to support effective identification, assessment, escalation and mitigation of Canadian privacy risk.
- Provide 2LOD oversight and effective challenge of potential privacy and data breach incidents affecting Amex Bank of Canada and Canadian customers, applicants, employees and other individuals, as applicable.
- Review privacy incident assessments performed by 1LOD and other relevant stakeholders and independently assess the application of Canadian privacy requirements.
- Assess potential breaches against applicable Canadian legal and regulatory notification requirements and provide recommendations to the LECO/Privacy Officer regarding whether notification to affected individuals, the OPC or other applicable Canadian authorities is required.
- Support the LECO/Privacy Officer in documenting regulatory reporting and notification determinations, including the rationale supporting reportability and non-reportability decisions.
- Provide oversight and challenge of 1LOD management of personal information access requests, including timeliness, completeness, exemptions, escalations and other compliance considerations.
- Review complex or escalated privacy access matters and provide guidance and challenge to support compliance with applicable Canadian privacy requirements.
- Review and support responses to escalated privacy complaints, including complaints made to or involving the OPC, and coordinate with Legal, GPO, IPRM and relevant business teams as appropriate.
- Support the LECO/Privacy Officer in regulatory inquiries, investigations and other engagement with the OPC relating to privacy complaints or other privacy compliance matters.
- Support the execution and oversight of Privacy Risk Assessments for Canadian initiatives, products, processes, technologies and changes, acting under the Bank's local Privacy Officer delegation model where applicable.
- Partner with GPO and IPRM to apply enterprise privacy risk management frameworks within the Canadian regulatory context, while identifying and escalating Canadian-specific legal, regulatory or risk considerations.
- Provide effective challenge where global privacy requirements, assessments or controls require augmentation to appropriately address Canadian legal entity requirements.
- Identify emerging privacy risks, control gaps and recurring themes arising from breaches, access requests, complaints and Privacy Risk Assessments, and escalate material concerns to the LECO/Privacy Officer and other appropriate governance forums.
- Support privacy risk reporting and governance for Canada, including development of metrics, trends and insights for senior management and applicable risk committees.
- Support the assessment of Canadian privacy regulatory developments and their potential impact on the Bank's policies, standards, procedures, controls and business practices.
- Partner closely with Legal, Operational Risk, Information Security, Technology, business teams, GPO, IPRM and other Compliance teams to support effective management of privacy risk.
- Contribute to enhancements to the Bank's privacy compliance framework, including policies, procedures, governance, controls, training and monitoring.
- Maintain appropriate records and evidence supporting 2LOD privacy oversight, challenge, regulatory assessments and key decisions.
- 5-7 years of relevant experience in privacy compliance, privacy law, regulatory compliance, or privacy risk management, preferably within a Canadian financial institution or other highly regulated organization.
- University degree in law, business, risk management, privacy, information management or a related discipline, or equivalent relevant professional experience.
- CIPP/C, CIPP/E, CIPM or other recognized privacy certification considered a strong asset.
- Strong knowledge of Canadian privacy and data protection requirements, particularly PIPEDA, associated regulations and guidance issued by the Office of the Privacy Commissioner of Canada.
- Demonstrated experience assessing privacy/data breaches, including application of regulatory breach notification and reporting requirements.
- Experience with privacy access requests, privacy complaints, regulatory inquiries and/or privacy risk or impact assessments.
- Strong analytical skills and regulatory judgement, including the ability to assess complex fact patterns against legal and regulatory requirements and develop clear, well-supported recommendations.
- Excellent written and verbal communication skills, including the ability to communicate complex privacy matters clearly to senior leaders, business partners and risk stakeholders.
- Strong stakeholder-management skills and demonstrated ability to work effectively across Legal, Compliance, Risk, Technology, Information Security and business teams.
- Ability to manage multiple complex and potentially time-sensitive matters, including privacy incidents and regulatory deadlines.
- Experience engaging with or responding to matters involving the Office of the Privacy Commissioner of Canada.
- Experience conducting or reviewing Privacy Impact Assessments, Privacy Risk Assessments or similar privacy-by-design assessments.
- Familiarity with enterprise privacy governance frameworks and working within global organizations where local regulatory requirements must be integrated with enterprise standards.
The stated salary range represents the expected compensation for this job requisition. Ultimately, in determining your pay, we’ll consider your locati