Manager of Compliance - Privacy

Reporting to the Director of Compliance Advisory & Deputy Privacy Officer, the Manager of Compliance - Privacy will play a key role in supporting Amex Bank of Canada's ("the Bank") Canadian privacy compliance and risk management program.

The Manager will support the Legal Entity Compliance Officer ("LECO") and Canadian Privacy Officer through Second Line of Defence ("2LOD") oversight, effective challenge and regulatory assessment of privacy and data protection matters affecting the Bank.

The role will have four primary areas of responsibility:

1. Privacy and Data Breach Oversight - Provide 2LOD oversight and challenge of potential privacy and data breach cases affecting Canada, including assessment of incidents against applicable Canadian legal and regulatory requirements and recommendations regarding notification and regulatory self-reporting obligations.
2. Privacy Access Request Oversight - Provide 2LOD oversight and challenge of First Line of Defence ("1LOD") execution of personal information access requests, including review of escalated or complex matters and assessment against applicable Canadian privacy requirements.
3. Privacy Complaints and Regulatory Engagement - Review and support responses to escalated privacy complaints, including matters involving or referred to the Office of the Privacy Commissioner of Canada ("OPC"), and support the LECO/Privacy Officer in regulatory engagement and remediation arising from privacy complaints.
4. Privacy Risk Assessments and Governance - Support and, where delegated, execute Canadian Privacy Officer responsibilities relating to Privacy Risk Assessments and other privacy risk governance activities, partnering closely with Global Privacy Oversight ("GPO"), International Privacy Risk Management ("IPRM"), Legal, business teams and other risk partners.

The Manager will serve as a key Canadian privacy compliance subject matter expert and will be expected to maintain a strong understanding of applicable Canadian privacy and data protection requirements, including PIPEDA and related regulatory guidance, as well as relevant internal American Express privacy policies, standards and procedures.

The role requires sound regulatory judgement, strong analytical and written communication skills, and the ability to provide credible and independent challenge to business and risk partners. The Manager will work closely with stakeholders across the Bank and the broader American Express organization to support effective identification, assessment, escalation and mitigation of Canadian privacy risk.