SENIOR DATA PRIVACY LEAD

CARE is an international NGO with local staff and community partners in more than 90 countries. We create local solutions to poverty and inequality and we seek dignity for everyone every day and during times of crisis. These solutions have a broad range, from clean water to access to education; from microfinance to ensuring that everyone has nutritious food; from agriculture and climate change to disaster response. CARE puts women and girls at the center of everything we do because they have proven to be the best hope for creating lasting change in the world. Our staff live where they work, which makes us effective at understanding the challenges they face. We’ve been doing this for over 70 years, since World War II. It started with the world’s first CARE Package® of food for the post-war hungry in Europe. Our work today is as important as ever, we believe that poverty and inequality are historic injustices that we can end within a generation, for good. If you share our core beliefs: poverty is an injustice; poverty is solvable; and together, we have the power to end it, join us, and fight with CARE

The role focuses on assessing the appropriate use of beneficiary and program information in projects & contract agreements and providing subject matter expertise on privacy and data protection to business stakeholders to ensure incorporation of privacy-by-design into all required business processes, critical projects and initiatives. The resource in this role will conduct Privacy Impact Assessments on projects, conduct Contract Due Diligence, lead data inventorying efforts, and collaborating with business units to identify solutions to minimize data privacy risks. This resource will also assist in developing the privacy program via creating/updating data security policies, authoring guidelines and playbooks to document Privacy Program processes and requirements, and improve the Privacy risk register and associated metrics/KPI reporting for assessing overall privacy compliance wellness. The Responsible Data Lead must have a mix of skills from the ability to work on many projects at the same time, to project management, stakeholder management, capacity strengthening and change management, knowledge of and experience with Responsible Data and related networks.

Responsibilities:

Enterprise Data Management and Governance

• Enterprise Data Privacy Strategy and Management: Understand CARE’s enterprise data architecture and interface guidelines. Lead development and update of responsible data policies, standards, tools and guidelines.
• Assess and manage review process of Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs), analyzing responses to identify risks involving the collection, access, use, protection, storage and destruction of personal and/or sensitive information. Communicate data privacy related risks and develop and advise on the implementation of risk mitigation plans.
• Business Development: Collaborate with Resource Development team to identify potential funders and develop and deliver compelling proposals to secure funding for CARE’s data infrastructure and capabilities. Support proposal development teams to include sufficient funding and resources for responsible data management.

Programmatic Responsible Data Practices and Awareness

• RoPAs: Lead data inventorying, data processing, business process documentation projects with data owners across the organization, and other efforts to maintain proper Records of Processing Activities (RoPAs) 2. Capacity Strengthening: Develop toolkits, frameworks, tool catalogues and other guidance that will help Country Offices to more effectively leverage best practices and to strengthen organizational Responsible Data capacity across the project lifecycle from fundraising and, design, to implementation, evaluation, and learning.
• Strengthen CARE’s Responsible Data Community: Creating and fostering a network of Responsible Data Champions strengthen and ensure the integration of Responsible Data standards and practices into our management of data across CARE’s programs and offices.
• Strategic Partnerships, Outreach and Alignment: Work collaboratively with Global, Regional and Country Office staff to identify opportunities in CARE’s current strategic programming where support with responsible data could be beneficial.

Program Management

• Project Management: Manage the successful design and implementation of responsible data initiatives, such as the Advisory Group, various Task Teams, and project support.
• Management and Planning: Responsible for the strategic planning of this capacity, including developing budgets, adhering to donor requirements, and managing workplans, as relevant.
• Act as a subject matter expert in day-to-day privacy operational matters, providing data privacy and data protection expertise. This includes working closely with internal stakeholders in various corporate functions and lines of business to analyze and respond to their privacy-related issues and questions.
• Lead meetings and regularly liaise with product and business teams to ensure the CARE Digital remains abreast on new projects/products and that privacy-by-design principles being followed for them.
• Collaborates with our Country Offices and Digital Cybersecurity team on activities involving PII such as potential breach incidents, vendor transmission of PII, or company-wide risk assessments.

Qualifications:

• Bachelor’s degree in Digital Technology, Science, or other related fields
• Master’s degree in Data Science/Management, Political Science or experience in lieu of formal education.
• Data or cybersecurity related professional certifications: CIPP/US, CIPP/E, CIPT, CIPM, CIPP/C, CISSP.
• 7+ years of Privacy experience, with the ability to apply critical thinking to a Data Protection & Privacy objective
• 8+ years of analytical experience, preferably in Information Technology, such as in a business analyst role. Able to rigorously document and keep up to date data and business process flows
• Advanced hands-on experience in operational and technical aspects of data privacy and protection. This includes, experience reviewing Privacy Impact Assessments and experience conducting Vendor risk assessments for a large corporation
• Excellent working knowledge of privacy and data protection laws & regulations, including COPPA, CCPA/CPRA, the EU GDPR, the UK GDPR, CAN-SPAM, CASL, HIPAA, etc.
• Familiar with Privacy issues related to digital ad tech, such tags, cookies, pixels, and tag management systems such as Tealium, Google Tag Manager, Adobe Dynamic Tag Manager, etc.
• Fluency in a second language
• Proficiency in Microsoft Business Applications-Teams, SharePoint, OneDrive, Powerpoint, OneNote is essential for communication and organizing artifacts