Executive Director of Privacy Program Services

Job Summary

The Executive Director of Privacy Program Services (EDPPS) position will serve as Deputy Privacy Officer and will be responsible for the privacy and data protection program at Drexel University. In this role, the EDPPS is responsible to promote the privacy, protection and confidentiality of restricted, proprietary, or personal information for member of the Drexel University community including but not limited to students, faculty, staff, research subjects, patients and others and ensure that Drexel complies with all data privacy and data protection laws that apply to the University’s internal and external-facing operations.

Essential Functions

• Drafts, revises and implements policies and procedures to ensure compliance with applicable privacy and data protection law, regulations, rules and standards, and the University’s contractual commitments. This includes monitoring and advising the Drexel community on all issues related to the protection and confidentiality of personal data under applicable data protection laws, including, but not limited to the Family Educational Rights and Protection Act (FERPA), the Health Insurance Portability and Accountability Act (HIPA) privacy and breach notification rules, the General Data Protection Regulation (GDPR), and various state and local laws and regulations.
• Provides guidance to colleges, schools and business units on all aspects of privacy and data protection. This includes liaising with colleges, schools and business units across the University in relation to the development of policies, procedures and practices.
• Manages research privacy program to ensure appropriate protection of the personal information of research participants including human subjects and oversees appropriate review of contracts and other agreements.
• Fosters a privacy and data protection culture within the University and helps to implement essential Fair Information Privacy Principles (FIPPs) in accordance with the University’s Privacy Plan.
• Develops, implements, and monitors privacy policies and controls that foster a culture of Privacy by Design and Privacy by Default.
• Assists in the development and implementation of Privacy Program monitoring and audits to ensure competent, documented data inventories, flows and compliance to address potential issues proactively. Provides advice on Data Protection Impact Assessments (DPIAs) and monitor their performance. 
• Educates, advises and coaches the University community on applicable privacy compliance requirements on a timely and regular basis by providing training and awareness modules and communications. Creates privacy and data protection training and awareness plans coordinated with other University units and Enterprise Learning. Monitor sand track training campaigns to completion.
• Maintains comprehensive records of all data processing activities, including data flow diagrams and privacy impact assessments.
• As the trusted advisor for the University community on privacy and data protection inquiries and complaints, participates in, directs investigation of and advises on containment, mitigation, reporting and resolution of security incidents and investigations, or privacy complaints and reports, as necessary.
• Directs and oversees team of privacy managers and analysts and ensures regular participation in student co-op programs with Kline Law and other University colleges and schools.
• Designs and directs content of the Privacy website
• Provides leadership and support to various University committees, e.g., Audit Committee of the Board of Trustees, Privacy and Security Compliance Committee, Enterprise Risk Management Committee, Cybersecurity and Privacy Incident Response Team, etc.
• Manages day-to-day operation of the Privacy and Data Protection Program, providing overall direction and advice for privacy and data protection compliance, including review of agreements with third parties and others for use, disclosure and processing of sensitive University information.
• Collaborates with colleges, schools and administrative units to direct the preparation and maintenance of appropriate privacy and confidentiality consent and authorization forms, information notices and materials consistent with the University's practices and requirements for protection of personal information.
• Maintains current knowledge of applicable international, federal and state privacy and data protection laws, regulations, rules and accreditation standards, and monitors advancements in information privacy technologies.
• Additional manager assigned duties and/or projects, as required.

Required Qualifications

• Minimum of master's degree or the equivalent combination of education and work experience. 
  • Please review the