Director of Privacy

Privacy Governance & Strategy 

• Act as AiGC’s primary lead for ensuring compliance with applicable Alberta privacy and access to information legislation, principally POPA and ATIA – both within AiGC itself and, because operators act as agents of AiGC, in respect of the personal information operators collect, use and disclose on AiGC’s behalf.
• Build out the privacy function from the ground up, standing up the processes, tools, templates, registers and record-keeping required to operate access to information requests, operator consents, records management, privacy complaints and breach response.
• Develop, draft, implement and maintain AiGC’s privacy management program, including policies, procedures, standards, guidelines and supporting templates and review them on a defined cycle so that they remain current with legislation change and operational practice.
• Monitor legislative and regulatory developments (including common law precedents) and advise leadership on operational implications for the iGaming sector.
• Report to the executive team on privacy risk, program maturity, incidents, access to information volumes and compliance metrics.

Oversight & Compliance 

• Foster a culture of collaboration and engagement between the AiGC and private iGaming operators to ensure all stakeholders adhere to data privacy standards.
• Lead the development, review, and submission of Privacy Impact Assessments (PIAs) for all new or substantially modified programs, data linkages, and systems involving operator data.
• Be the primary contact between the Office of the Information and Privacy Commissioner of Alberta (OIPC) and the AiGC, owning that relationship and managing all correspondence, consultations, notifications, investigations, reviews and inquiries and coordinating AiGC’s responses, undertakings and remediation commitments.
• Manage privacy complaints and OIPC-initiated investigations, reviews and inquiries from intake through to resolution, including implementation of any resulting orders or recommendations. 
• Ensure consistent application of privacy-related provisions across the Corporation, particularly regarding the unique data-sharing relationships between AiGC as the conduct/management entity and private operators. Establish and run a privacy assurance program over operators, including review and approval of operator privacy documentation, periodic compliance reviews and audits, remediation tracking and escalation under the Operating Agreements.
• Collaborate with operational teams to ensure data privacy obligations are consistently met across all iGaming operations.

Contract & Data Management 

• Manage the lifecycle of privacy-related contracts, specifically drafting and reviewing language to mitigate privacy and information security risks.
• Review and maintain privacy contract templates to ensure alignment with legislative, regulatory, and organizational requirements.
• Maintain contract tracking mechanisms to monitor key dates, compliance obligations, and risk exposure related to data processing.

Incident Management 

• Lead the assessment and response to privacy incidents and potential breaches, including investigation, documentation, and remediation.
• Determine regulatory notification requirements and coordinate communications with the Office of the Information and Privacy Commissioner (OIPC) and affected individuals.

Access to Information & Records Management 

• Oversee and administer the access to information request process, ensuring compliance with statutory timelines and disclosure requirements.
• Design, implement and administer the end-to-end access to information process under ATIA, including intake, fee estimates, search and retrieval, third-party notice, severing, response and management of requests for review.
• Establish and maintain AiGC’s records management program, including records classification, retention and disposition schedules, defensible disposal, and the treatment of transitory records. 
• Coordinate legal holds and preservation obligations with the General Counsel in connection with litigation, regulatory reviews and investigations. 

Leadership and Cross-Collaboration 

• Build, resource, lead and develop the internal privacy team as the function grows, including recruitment, onboarding, coaching, performance management and day-to-day supervision.
• Collaborate with other stakeholders, including legal, technology, compliance and operator personnel to ensure alignment and compliance with applicable privacy legislation.
• Design and deliver privacy training and awareness for AiGC staff, contractors and the Board and set training expectations for operators.
• Act as a trusted advisor to the executive team and business units, embedding privacy by design into new products, systems, marketing activities, data analytics and vendor selection.
• Work with the CIO and information security function to align privacy and security controls, access management and incident response.