Access and Privacy Specialist

Reporting to the Director, Risk, Privacy & Compliance, the Access & Privacy Specialist is responsible for supporting enterprise-wide compliance and operational alignment with Manitoba’s Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Health Information Act (PHIA) within a Crown corporation environment.

Operating within a highly regulated, publicly accountable organization, the Specialist ensures that access to information and privacy practices are consistent, defensible, citizen-focused, and aligned with statutory obligations, corporate policy, and public sector expectations for transparency and trust.

The role provides advisory services, coordinates access requests, supports privacy risk management, and works collaboratively across business units to embed compliant practices into programs, services, and technology initiatives

Responsibilities:

• Responsible for coordinating, preparing, and responding to all requests, forms, and Requests for Access under FIPPA and PHIA, and acts as a main point of contact for external and internal contacts.
• Serves as a first point of contact to the public and an access and privacy resource to all areas within Manitoba Public Insurance (MPI) by coordinating and monitoring the assembly and review of material relevant to formal responses to all Request for Access under FIPPA and requests for access under PHIA, including:
• Coordinating with applicable departments for the assembly of records and required documentation
• Reviewing records and documentation and determining whether the records sought are accessible under the legislation, whether any of the statutory exemptions to disclosure apply, and whether any records can be released with severing.
• Documenting the application of exemptions (as required).
• Determining whether an application should be transferred to another public body and, if so, arranging the transfer
• Monitoring the progress of the response process and providing a formal response within the legislated time frames
• Determining whether an extension of time is required to respond and, if so, arranging the extension
• Preparing estimates of costs as required
• Communicating with the applicant or affected third parties regarding the scope and nature of the inquiry, timing, and any follow-up required.
• Receives, investigates, tracks, and responds in a timely fashion to “refusal of access” and privacy complaints lodged with the Manitoba Ombudsman under both FIPPA and PHIA.
• Ensures the implementation of any remedial action recommended by the Ombudsman as a result of a complaint.
• Prepares quarterly and annual summary reports for senior management on access and information request volumes, metrics, and trends.
• Coordinates, assists or responds to other information requests for records received directly or by other business areas.
• Investigate and coordinate responses to reports and allegations of privacy breaches of personal information under FIPPA and personal health information under PHIA and make recommendations for immediate and long-term corrective measures as necessary to protect the confidentiality, integrity and security of all personal information and personal health information, as well as sensitive corporate and business information.
• Develops, maintains, and provides privacy training to employees and other members of the MPI community.
• Coordinates privacy impact assessments (PIAs) to be conducted as required and provides advice on initial and periodic privacy risk assessments of information handling practices and conducts related ongoing compliance monitoring activities.
• Drafts policies and procedural changes governing various access and privacy issues.
• Works with Information & Technology to align information handling and privacy practices with current and emerging processing and security technologies.
• Works with legal counsel, management, key departments, and committees to ensure that MPI:
• has available, and routinely uses, customer consent and authorization forms which comply with the relevant legislation
• provides readily accessible notices and information to the public regarding its privacy and information handling policies and practices
• Works with MPI’s legal counsel to ensure that all contractual arrangements between MPI and third parties comply with the applicable statutory requirements regarding processes and responsibilities for ensuring and respecting privacy. As required, assists in drafting Memoranda of Understanding as part of the contractual arrangements and participates in the ongoing compliance and monitoring of these arrangements.
• Works with Human Resources and other business units to ensure compliance with information handling and privacy practices throughout MPI, and to ensure the consistent application of sanctions for failure to comply with those practices.
• Remains up-to-date on changes and amendments to applicable legislation and regulations, and on applicable court and administrative tribunal decisions having access or privacy implications.
• Provides advice to MPI divisions and departments regarding access to information, and protection of personal privacy.

Qualifications:

Education:

• Post-secondary degree in social sciences, public or business administration or other relevant discipline.

Experience:

• Five years of related experience working with access and privacy issues.
• Related education, training and experience may be considered.

Technical Knowledge and Skills:

• Knowledge and understanding of FIPPA and PHIA and, to a lesser extent, the access and privacy provisions of The Mental Health Act.
• Demonstrated strong judgment, diplomacy and political acumen, specifically regarding sensitive inquiries.
• Good understanding of internationally recognized principles and standards for “fair information handling”.
• Demonstrated organizational, facilitation, and presentation skills.
• Knowledge and understanding of the records management provisions of The Manitoba Public Insurance Corporation Act (MPIC Act), The Drivers and Vehicles Act (DVA), and The Highway Traffic Act (HTA).
• General familiarity with The Archives and Recordkeeping Act, and with the Personal Information Protection and Electronic Documents Act (Canada).