Full time | Mid-Level | Reports to the Interim Chief Compliance Officer<\/p>\n
Hybrid role (2 days in-office requirement).<\/p>\n
Position Summary<\/strong><\/p>\n WealthONE is seeking an experienced Senior Manager, Compliance & Privacy to own and mature the Bank\u2019s Privacy Compliance Program. This senior role is responsible for all aspects of privacy compliance, from regulatory monitoring and Privacy Impact Assessments to breach management and OPC liaison, with a strong and specific emphasis on Privacy by Design (PbD) as a strategic and operational discipline embedded across the Bank\u2019s products, services, and technology initiatives. The successful candidate will be the Bank\u2019s subject matter expert on Canadian privacy law, a trusted advisor to business lines, and a champion of privacy-by-design culture across the organization.<\/p>\n KEY RESPONSIBILITIES<\/strong><\/p>\n 1.\u00a0\u00a0\u00a0 Privacy Program Management<\/strong><\/p>\n Own, manage, and mature the Bank\u2019s end-to-end Privacy Compliance Program, ensuring full alignment with PIPEDA\u2019s 10 Fair Information Principles, the Privacy Act, Bill C-27, and applicable provincial privacy legislation. 2.\u00a0\u00a0\u00a0 Privacy by Design (PbD) \u2013 Program Leadership<\/strong><\/p>\n Champion Privacy by Design as a core organizational value. 3.\u00a0\u00a0\u00a0 Privacy Impact Assessments (PIAs)<\/strong><\/p>\n Lead and conduct PIAs for all new products, services, technologies, and business processes involving personal information. 4.\u00a0\u00a0\u00a0 Privacy Breach Management<\/strong><\/p>\n Lead the Bank’s privacy breach response program \u2014 including breach identification, containment, risk assessment, and mandatory breach notification under PIPEDA and the CPPA. 5.\u00a0\u00a0\u00a0 Consent Management & Individual Rights<\/strong><\/p>\n Oversee the Bank’s consent management framework \u2014 ensuring all personal information is collected, used, and disclosed with valid, meaningful, documented consent under PIPEDA. 6.\u00a0\u00a0\u00a0 OPC Regulatory Liaison & Compliance<\/strong><\/p>\n Serve as the Bank’s primary point of contact with the Office of the Privacy Commissioner of Canada (OPC) for all privacy regulatory interactions \u2014 complaints, investigations, audits, and voluntary consultations. 7.\u00a0\u00a0\u00a0 Third-Party & Vendor Privacy Management<\/strong><\/p>\n Oversee the Bank’s vendor privacy risk management program \u2014 reviewing and negotiating privacy and data processing provisions in all vendor contracts. 8.\u00a0\u00a0\u00a0 Privacy, Training, Awareness & Culture<\/strong><\/p>\n Design, deliver, and maintain an annual privacy training program for all Bank employees \u2014 covering PIPEDA obligations, privacy policies, breach reporting, and PbD principles. 9.\u00a0\u00a0\u00a0 RCM Program Integration<\/strong><\/p>\n Ensure privacy compliance \u2014 including PbD controls \u2014 is fully integrated into the Bank’s Regulatory Compliance Management (RCM) program with defined controls, monitoring metrics, and testing protocols. QUALIFICATIONS & EXPERIENCE<\/strong><\/p>\n Required:<\/strong><\/p>\n Minimum 7 years of progressive compliance, privacy, or legal experience in a federally regulated financial institution Preferred:<\/strong><\/p>\n Professional privacy designation \u2014 CIPP\/C, CIPM, or CIPT (IAPP) What You Need to Know<\/strong><\/p>\n At WealthONE, our people are our greatest asset. You\u2019ll become part of a diverse and growing team that acknowledges everyone\u2019s unique talents to do what\u2019s right for the client, and to do it well.\u00a0 As part of our team, you will:<\/p>\n Thrive: Benefit from an open and approachable culture that provides the flexibility and support you need to integrate your life at work and at home. WealthONE is an equal opportunity employer committed to creating an inclusive environment where all team members and clients feel like they belong.<\/p>\n
Maintain and update the Privacy Program documentation to reflect legislative changes and OPC guidance.
Develop and maintain a comprehensive privacy regulatory requirements library covering all applicable federal and provincial privacy obligations.
Prepare and present quarterly and annual privacy compliance reports to the Interim Chief Compliance Officer and senior management.
Monitor OPC findings, guidance documents, and enforcement decisions for applicability to the Bank\u2019s operations and update the program accordingly.<\/p>\n
Embed privacy requirements into the Bank\u2019s project governance and product development lifecycle.
Lead privacy architecture reviews for all new digital banking platforms, mobile applications, core banking system changes, cloud migrations, and third-party technology integrations.
Apply PbD principles to the Bank\u2019s open banking \/ CBDA implementation.
Lead the Bank\u2019s data minimization and purpose limitation program.
Design and implement privacy-by-default settings for all consumer-facing digital products and services.
Establish and maintain a Personal Information Inventory (data map) for the Bank.
Oversee the Bank\u2019s Records Retention and Destruction Program as it relates to personal information.<\/p>\n
Identify privacy risks and provide practical, risk-based PbD recommendations.
Maintain a PIA registry and track implementation of all PIA recommendations to closure.
Assess the privacy management, data portability, and third-party data sharing.<\/p>\n
Assess whether a breach constitutes a ‘real risk of significant harm’ requiring OPC notification and individual notification \u2014 coordinating responses within regulatory timelines.
Maintain the breach register and conduct post-breach root cause analyses.
Liaise with IT Security, Operations, and Legal during privacy breach response.<\/p>\n
Manage individual access requests, correction requests, and privacy complaints \u2014 ensuring timely and compliant responses.
Design and oversee consumer consent mechanisms for open banking \/ CDBA data sharing \u2014 ensuring consent is granular, revocable, and fully auditable.
Ensure opt-in consent mechanisms (not opt-out) are used for all non-essential data collection \u2014 consistent with PbD Principle 2.<\/p>\n
Coordinate the Bank’s response to OPC complaints and prepare formal submissions in coordination with Legal.
Prepare for and support OPC audits and examinations \u2014 maintaining all required records in a readily retrievable format.
Monitor OPC Commissioner’s findings, guidance, and CPPA transition guidance for applicability to the Bank.<\/p>\n
Conduct vendor privacy assessments using a risk-based approach.
Apply PbD principles to vendor selection and onboarding.
Ensure personal information transferred to third parties \u2014 including cloud providers and open banking accredited entities \u2014 is protected to PIPEDA-equivalent standards.<\/p>\n
Create PbD awareness resources \u2014 guidelines, quick reference cards, checklists \u2014 to help staff embed privacy at the design stage.
Foster a culture in which privacy is seen as a value and a competitive advantage, not a compliance burden.<\/p>\n
Conduct and support internal control testing of privacy controls as part of the annual RCM testing program.
Identify privacy compliance deficiencies and manage remediation through to closure.
Prepare privacy compliance metrics and KPIs for management reporting and board-level governance reporting.
\u00a0<\/p>\n
Deep, hands-on knowledge of PIPEDA \u2014 including Fair Information Principles, breach notification, consent requirements, and individual access rights
Demonstrated experience implementing Privacy by Design \u2014 applying PbD principles in product development, technology projects, or digital transformation initiatives
Experience conducting Privacy Impact Assessments and managing privacy breach response including OPC notifications
Knowledge of Bill C-27 and its anticipated impact on federally regulated FIs
Familiarity with provincial privacy legislation \u2014 Quebec Law 25, BC PIPA, Alberta PIPA
University degree in law, business, compliance, information management, or a related field
Strong written and verbal communication skills \u2014 ability to advise senior management and write clear, plain-language privacy policies, PIAs, and assessments<\/p>\n
Formal training or certification in Privacy by Design (e.g., IAPP PbD certification, Ann Cavoukian PbD practitioner training)
Experience with CDBA \/ open banking privacy obligations \u2014 consent management and data portability
Experience managing OPC investigations, complaints, or audits
Familiarity with GDPR and cross-border data transfer requirements
Experience with privacy technology tools \u2014 consent management platforms or data mapping tools
Knowledge of CASL and its intersection with privacy
\u00a0<\/p>\n
Connect: Work in a place that fosters creativity and collaboration.
Develop: Apply your skills and grow your career in a young, fast-growing environment.
Prosper: Share in our collective success with a competitive salary, incentive pay, and excellent health benefits program.
\u00a0<\/p>\n