Manager of Compliance - Privacy

Job Description

Reporting to the Director of Compliance Advisory & Deputy Privacy Officer, the Manager of Compliance - Privacy will play a key role in supporting Amex Bank of Canada's ("the Bank") Canadian privacy compliance and risk management program.

The Manager will support the Legal Entity Compliance Officer ("LECO") and Canadian Privacy Officer through Second Line of Defence ("2LOD") oversight, effective challenge and regulatory assessment of privacy and data protection matters affecting the Bank.

The role will have four primary areas of responsibility:

1. Privacy and Data Breach Oversight - Provide 2LOD oversight and challenge of potential privacy and data breach cases affecting Canada, including assessment of incidents against applicable Canadian legal and regulatory requirements and recommendations regarding notification and regulatory self-reporting obligations.
2. Privacy Access Request Oversight - Provide 2LOD oversight and challenge of First Line of Defence ("1LOD") execution of personal information access requests, including review of escalated or complex matters and assessment against applicable Canadian privacy requirements.
3. Privacy Complaints and Regulatory Engagement - Review and support responses to escalated privacy complaints, including matters involving or referred to the Office of the Privacy Commissioner of Canada ("OPC"), and support the LECO/Privacy Officer in regulatory engagement and remediation arising from privacy complaints.
4. Privacy Risk Assessments and Governance - Support and, where delegated, execute Canadian Privacy Officer responsibilities relating to Privacy Risk Assessments and other privacy risk governance activities, partnering closely with Global Privacy Oversight ("GPO"), International Privacy Risk Management ("IPRM"), Legal, business teams and other risk partners.

The Manager will serve as a key Canadian privacy compliance subject matter expert and will be expected to maintain a strong understanding of applicable Canadian privacy and data protection requirements, including PIPEDA and related regulatory guidance, as well as relevant internal American Express privacy policies, standards and procedures.

The role requires sound regulatory judgement, strong analytical and written communication skills, and the ability to provide credible and independent challenge to business and risk partners. The Manager will work closely with stakeholders across the Bank and the broader American Express organization to support effective identification, assessment, escalation and mitigation of Canadian privacy risk.

Responsibilities

• Provide 2LOD oversight and effective challenge of potential privacy and data breach incidents affecting Amex Bank of Canada and Canadian customers, applicants, employees and other individuals, as applicable.

• Review privacy incident assessments performed by 1LOD and other relevant stakeholders and independently assess the application of Canadian privacy requirements.

• Assess potential breaches against applicable Canadian legal and regulatory notification requirements and provide recommendations to the LECO/Privacy Officer regarding whether notification to affected individuals, the OPC or other applicable Canadian authorities is required.

• Support the LECO/Privacy Officer in documenting regulatory reporting and notification determinations, including the rationale supporting reportability and non-reportability decisions.

• Provide oversight and challenge of 1LOD management of personal information access requests, including timeliness, completeness, exemptions, escalations and other compliance considerations.

• Review complex or escalated privacy access matters and provide guidance and challenge to support compliance with applicable Canadian privacy requirements.

• Review and support responses to escalated privacy complaints, including complaints made to or involving the OPC, and coordinate with Legal, GPO, IPRM and relevant business teams as appropriate.

• Support the LECO/Privacy Officer in regulatory inquiries, investigations and other engagement with the OPC relating to privacy complaints or other privacy compliance matters.

• Support the execution and oversight of Privacy Risk Assessments for Canadian initiatives, products, processes, technologies and changes, acting under the Bank's local Privacy Officer delegation model where applicable.

• Partner with GPO and IPRM to apply enterprise privacy risk management frameworks within the Canadian regulatory context, while identifying and escalating Canadian-specific legal, regulatory or risk considerations.

• Provide effective challenge where global privacy requirements, assessments or controls require augmentation to appropriately address Canadian legal entity requirements.

• Identify emerging privacy risks, control gaps and recurring themes arising from breaches, access requests, complaints and Privacy Risk Assessments, and escalate material concerns to the LECO/Privacy Officer and other appropriate governance forums.

• Support privacy risk reporting and governance for Canada, including development of metrics, trends and insights for senior management and applicable risk committees.

• Support the assessment of Canadian privacy regulatory developments and their potential impact on the Bank's policies, standards, procedures, controls and business practices.

• Partner closely with Legal, Operational Risk, Information Security, Technology, business teams, GPO, IPRM and other Compliance teams to support effective management of privacy risk.

• Contribute to enhancements to the Bank's privacy compliance framework, including policies, procedures, governance, controls, training and monitoring.

• Maintain appropriate records and evidence supporting 2LOD privacy oversight, challenge, regulatory assessments and key decisions.

Qualifications

• 5-7 years of relevant experience in privacy compliance, privacy law, regulatory compliance, or privacy risk management, preferably within a Canadian financial institution or other highly regulated organization.
• University degree in law, business, risk management, privacy, information management or a related discipline, or equivalent relevant professional experience.
• CIPP/C, CIPP/E, CIPM or other recognized privacy certification considered a strong asset.
• Strong knowledge of Canadian privacy and data protection requirements, particularly PIPEDA, associated regulations and guidance issued by the Office of the Privacy Commissioner of Canada.
• Demonstrated experience assessing privacy/data breaches, including application of regulatory breach notification and reporting requirements.
• Experience with privacy access requests, privacy complaints, regulatory inquiries and/or privacy risk or impact assessments.
• Strong analytical skills and regulatory judgement, including the ability to assess complex fact patterns against legal and regulatory requirements and develop clear, well-supported recommendations.
• Excellent written and verbal communication skills, including the ability to communicate complex privacy matters clearly to senior leaders, business partners and risk stakeholders.
• Strong stakeholder-management skills and demonstrated ability to work effectively across Legal, Compliance, Risk, Technology, Information Security and business teams.
• Ability to manage multiple complex and potentially time-sensitive matters, including privacy incidents and regulatory deadlines.
• Experience engaging with or responding to matters involving the Office of the Privacy Commissioner of Canada.
• Experience conducting or reviewing Privacy Impact Assessments, Privacy Risk Assessments or similar privacy-by-design assessments.
• Familiarity with enterprise privacy governance frameworks and working within global organizations where local regulatory requirements must be integrated with enterprise standards.

The stated salary range represents the expected compensation for this job requisition. Ultimately, in determining your pay, we’ll consider your location, experience, and other job-related factors. 
 
Employment eligibility to work with American Express is required as the company will not pursue visa sponsorship for these positions 
 
The job posting is for an existing vacancy. 
 
We back you with benefits that support your holistic well-being so you can be and deliver your best. This means caring for you and your loved ones' physical, financial, and mental health, as well as providing the flexibility you need to thrive personally and professionally:

• Competitive base salaries  
• Bonus incentives  
• Support for financial-well-being and retirement  
• Comprehensive medical, dental, vision, life insurance, and disability benefits (depending on location)  
• Flexible working model with hybrid, onsite or virtual arrangements depending on role and business need  
• Generous paid parental leave policies (depending on your location)  
• Free access to global on-site wellness centers staffed with nurses and doctors (depending on location)  
• Free and confidential counseling support through our Healthy Minds program  

• Career development and training opportunities

American Express is committed to providing an inclusive and accessible work environment in which all people who apply for positions or who work for or on behalf of Amex are treated with dignity and respect and are provided with equal treatment with respect to employment, regardless of that person's age, sex, sexual orientation, gender identity, gender expression, race, colour, ancestry, ethnic or national origin, citizenship, religion or creed, marital status, family status, pregnancy, disability, record of offences, social condition or origin, political beliefs, association or activity or other factors prohibited under applicable Human Rights legislation (the “Prohibited Grounds”). If you have a disability and need accommodation, please speak with the Recruiter for more information.

Offer of employment with American Express is conditioned upon the successful completion of a background verification check, subject to applicable laws and regulations. 

About the company

At American Express, our culture is built on a 175-year history of innovation, shared values  and Leadership Behaviors, and an unwavering commitment to back our customers, communities, and colleagues. From delivering differentiated products to providing world-class customer service, we operate with a strong risk mindset, ensuring we continue to uphold our brand promise of trust, security, and service.

As part of Team Amex, you’ll experience our powerful backing with comprehensive support for your holistic well-being and many opportunities to learn new skills, develop as a leader, and grow your career. Here, your voice and ideas matter, your work makes an impact, and together, you will help us define the future of American Express.

About the organization

We back you with benefits that support your holistic well-being so you can be and deliver your best. This means caring for you and your loved ones' physical, financial, and mental health, as well as providing the flexibility you need to thrive personally and professionally:

• Competitive base salaries
• Bonus incentives
• Support for financial-well-being and retirement
• Comprehensive medical, dental, vision, life insurance, and disability benefits (depending on location)
• Flexible working model with hybrid, onsite or virtual arrangements depending on role and business need
• Generous paid parental leave policies (depending on your location)
• Free access to global on-site wellness centers staffed with nurses and doctors (depending on location)
• Free and confidential counseling support through our Healthy Minds program
• Career development and training opportunities