Director, Legal Counsel, Data & Privacy in Brampton

Come make your difference in communities across Canada, where authenticity, trust and making connections is valued - as we shape the future of Canadian retail, together. Our unique position as one of the country's largest employers, coupled with our commitment to positively impact the lives of all Canadians, provides our colleagues a range of opportunities and experiences to help Canadians Live Life Well. At Loblaw Companies Limited, we succeed through collaboration and commitment and set a high bar for ourselves and those around us. Whether you are just starting your career, re-entering the workforce, or looking for a new job, this is where you belong.

The Data Trust Office is an enablement-first function. We embed privacy and data governance into products and services to build customer trust and loyalty, ensuring compliance by design. As Director, you will play a pivotal role in shaping and driving Loblaw's enterprise privacy and data governance program. You will be accountable for executing the Data Trust strategy, overseeing risk management and compliance activities, developing policy, managing breaches, and fostering stakeholder engagement across the business. As Legal Counsel, you will serve as a key partner to the commercial legal team, providing privacy, data and cybersecurity subject matter expertise on complex commercial arrangements and supporting the development, review and negotiation of appropriate contractual protections. In both functions you will provide strategic, practical and business-oriented legal advice on privacy, data governance, CASL and related regulatory matters to the business, helping them navigate complex legal requirements while enabling the responsible use of data and innovation. This role reports to the Enterprise Privacy Officer.

WHAT YOU'LL DO:

• Champion privacy as a business enabler by driving stakeholder engagement and embedding privacy and data governance into products and services.
• Provide strategic legal advice on privacy, data governance, CASL and related regulatory matters across the business, including in connection with new products, services, technologies, digital initiatives, data uses, artificial intelligence, marketing and other strategic projects and transactions.
• Advise on the interpretation and application of privacy laws, CASL, related regulatory requirements and regulator guidance, translating legal requirements into practical, business-oriented advice.
• Conduct Data and Privacy Impact Assessments (DPIAs), identify and evaluate legal, regulatory, data and privacy risks, and provide practical, risk-based recommendations on appropriate controls and mitigation strategies.
• Partner with commercial legal counsel as the privacy, data and cybersecurity subject matter expert on commercial agreements involving personal information, data sharing, technology, vendors, artificial intelligence or access to Loblaw systems and data.
• Provide practical legal advice and support the negotiation and resolution of complex or escalated privacy, data and cybersecurity issues.
• Provide legal advice on consent and transparency requirements, data governance and lifecycle matters, and the responsible use of data, including in connection with artificial intelligence and emerging technologies.
• Oversee privacy breach, complaint and investigation management activities, including intake, escalation, investigation and response, and provide legal advice on notification obligations, regulatory risk, remediation and response strategy.
• Advise on privacy and CASL regulatory matters and engage with regulators, as appropriate, in connection with regulatory inquiries, investigations, complaints and other regulatory matters, including engagement and management of external legal counsel as appropriate.
• Recruit, lead, and develop a high-performing data and privacy team, including coaching and developing privacy professionals and fostering strong legal and risk judgment across the team.
• Stay ahead of evolving national privacy and health privacy laws, global regulatory developments, privacy-enhancing technologies, and emerging innovations (e.g., AI/LLMs), CASL and related regulatory developments, and advise on their legal, regulatory and business implications.
• Partner cross-functionally across the enterprise to continuously improve privacy-related policies, templates, guidance, processes and controls and create efficiencies while maintaining appropriate legal, cybersecurity and regulatory safeguards.

WHAT YOU BRING:

• Law degree and member in good standing with the Law Society of Ontario, with 7-10 years of relevant experience in an in-house legal department and/or compliance function, including significant experience advising on privacy and related regulatory matters.
• Experience at a leading law firm is also considered an asset.
• Practical, solutions-oriented and agile, with strong legal and business judgment and a demonstrated ability to navigate complex legal environments.