Privacy Counsel

We need to output HTML fragment with sections: About the role? Actually the job posting includes a job summary, responsibilities, experience requirements, physical requirements, why work for Nova Biomedical, work location, targeted salary range. We need to use headings for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. However we should only include sections that have real specific content. The posting includes a job summary (maybe "About the role" could be used). Responsibilities clearly present. Experience Requirements could map to Requirements or Qualifications. There's also "Physical Requirements And Working Conditions" maybe part of Requirements? Could be separate but not required heading. Benefits: "Why Work for Nova Biomedical" includes benefits list. Pay: "Targeted Salary Range: $175,000 to $215,000 annually". Schedule: "Hybrid in Waltham MA Monday - Thursday" maybe schedule. Also "Work Location: Hybrid in Waltham MA Monday - Thursday". So schedule could be that. We must not repeat job title as heading. No Job ID. Remove boilerplate like EEO etc. Not present. We must preserve all substantive information. Must not invent or summarize away detail. Must not include filler like "commensurate with experience". Not present. We need to output only HTML fragment, no /, no markdown fences. We need to use

for section headings. Use

• for any list of duties/requirements/benefits. Use

  for prose. We need to decide which sections to include: About the role (job summary), Responsibilities, Requirements (maybe combine experience requirements and physical requirements?), Benefits, Pay, Schedule. Possibly also Qualifications? But experience requirements could be qualifications. We'll include Requirements (or Qualifications). The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Skills. We can choose which to include based on content. We have responsibilities list (many bullet-like sentences). We'll make

  • for each responsibility. Experience requirements: list of items (Juris Doctor, bar admission, etc). We'll make
    • . Benefits: list from "Why Work for Nova Biomedical": Flexible Medical, Dental, & Vision Coverage; Competitive 401k company match; Bonus Program, Generous PTO and paid holidays; Generous Tuition reimbursement; Hybrid and flexible work arrangements; Professional development, engagement and events; Company marketplace for lunch and snacks in our Norwood, MA, Billerica, MA and Westbrook, ME offices; Company subsidized cafeteria in our Waltham, MA office. We'll make list. Pay: targeted salary range. Schedule: Hybrid in Waltham MA Monday - Thursday (maybe also work location). We'll put schedule. We also have physical requirements: could be part of Requirements or separate but not required heading. Could include under Requirements as a list. We must not create sections with filler. All sections have content. We need to preserve all substantive information: includes the job summary paragraph, the responsibilities paragraphs (some are sentences not bullet). We'll convert each sentence to
    • maybe. But we need to preserve all info; using
    • is okay as it's still content. The instruction: Use
      • for any list of duties/requirements/benefits. So we can turn responsibilities into list items. For prose like job summary we use

        . For experience requirements we can use list. We must not repeat job title as heading. No job title present in text? The posting didn't include explicit title but we assume it's Privacy Counsel. We'll not add heading for it. We must not include Job ID/requisition numbers. We must remove cookie/navigation/legal/EEO etc. Not present. Now produce HTML. Structure:

        About the role

        Job Summary Nova Biomedical is seeking a Privacy Counsel to provide legal oversight, risk assessment, and strategic guidance on privacy, data protection, and data-management matters across Nova Biomedical Corporation and its subsidiaries. The Privacy Counsel will help ensure compliance with applicable global privacy laws and regulations by developing and implementing privacy policies and procedures, reviewing contracts from a privacy perspective, conducting training, and advising business and technology teams on privacy and data-protection risks. This role will work closely with Governance, Risk and Compliance, Information Technology, Information Security, Legal, and business functions to protect Nova Biomedical from legal and compliance risks related to privacy, security, and data management. In partnership with the Vice President of Governance, Risk and Compliance, the Privacy Counsel will develop short- and long-term plans for managing privacy-related legal matters and minimizing risk to the business. A key near-term priority will be operationalizing and maturing Nova Biomedical’s global privacy program following its combination with Advanced Instruments.

        Responsibilities

        • Provide legal oversight and strategic guidance for Nova Biomedical’s privacy, data-management, and information-security programs in accordance with applicable U.S. and global privacy laws.
        • Advise business, technology, and legal stakeholders on privacy, data protection, security, and compliance matters.
        • Interpret and apply privacy requirements under the General Data Protection Regulation and applicable U.S. federal and state laws.
        • Implement, maintain, and enforce internal and external privacy policies, procedures, data-protection agreements, and related legal documentation.
        • Ensure privacy policies and procedures reflect evolving legal requirements and relevant industry practices.
        • Draft, review, negotiate, and manage privacy-related legal documents, including: Records of Processing Activities, Data Protection Impact Assessments, Privacy Impact Assessments, Privacy notices, Data Processing Agreements, Data-transfer agreements, Business Associate Agreements, Inter-Affiliate Data Transfer Agreements.
        • Analyze products, services, technologies, projects, and business initiatives for privacy and data-protection risks.
        • Conduct privacy impact assessments and recommend appropriate measures to mitigate identified risks.
        • Develop, deliver, and lead privacy and data-protection training programs.
        • Establish role-based privacy training, new-hire training, annual refreshers, and appropriate completion records.
        • Support enterprise risk-management activities by identifying, assessing, documenting, and escalating material privacy and data-protection risks.
        • Contribute to risk assessments, risk registers, executive reporting, and related governance activities.
        • Serve as a liaison among Information Technology, Information Security, Legal, Governance, Risk and Compliance, and relevant business functions on privacy and information-security matters.
        • Monitor changes in privacy, data-protection, and information-security laws and regulations.
        • Evaluate and communicate the potential impact of legal and regulatory developments on Nova Biomedical.
        • Collaborate with global team members, particularly stakeholders in the European Union, to promote consistent privacy practices and risk-mitigation strategies.
        • Research complex privacy and data-protection matters and provide practical legal advice and recommendations.
        • Serve as the primary legal point of contact for personal data breaches.
        • Lead the legal aspects of Nova Biomedical’s Personal Data Breach process in coordination with Information Technology, Information Security, and other stakeholders.
        • Establish breach-determination criteria, jurisdiction-specific notification requirements, escalation paths, defined responsibilities, and a centralized breach register.
        • Serve as the primary interface with the Data Protection Officer.
        • Support interactions with regulators and outside counsel when required.
        • Provide privacy-related legal support for strategic transactions and other mission-critical initiatives.
        • Support privacy due diligence and integration activities associated with mergers, acquisitions, and other strategic transactions.
        • Provide legal guidance regarding commercial agreements, compliance programs, and healthcare-industry requirements as needed.
        • Global Privacy Program Development: Own and operationalize an enterprise-wide data-subject-rights program.
        • Establish standardized processes for access, rectification, erasure, restriction, objection, portability, consent withdrawal, and opt-out requests involving the sale or sharing of personal data.
        • Develop standardized request-intake channels, response procedures, documentation requirements, and a centralized data-subject-rights log.
        • Ensure the data-subject-rights program addresses applicable requirements under the General Data Protection Regulation, United Kingdom privacy law, Swiss Federal Act on Data Protection, applicable U.S. state privacy laws, Brazil’s General Data Protection Law, China’s Personal Information Protection Law, Canada’s Personal Information Protection and Electronic Documents Act, and Quebec Law 25.
        • Build and maintain an external-facing privacy-notice framework.
        • Develop and maintain an appropriate U.S. employee privacy notice.
        • Maintain streamlined website and California privacy policies with clearly defined ownership and review cycles.
        • Bring applicable consumer-facing channels into compliance with U.S. consumer health-data laws, including the Washington My Health My Data Act, Nevada Senate Bill 370, and the Connecticut Data Privacy Act.
        • Develop and publish a standalone Consumer Health Data Privacy Policy where required.
        • Establish appropriate consent processes for collecting and processing consumer health data.
        • Establish recurring cookie-governance processes across Nova Biomedical web properties.
        • Implement periodic cookie scanning and inventory practices.
        • Establish region-appropriate cookie and tracking-technology consent configurations.
        • Implement required “Do Not Sell or Share My Personal Information” mechanisms and recognition of Global Privacy Control signals.
        • Establish, publish, and enforce a centralized data-retention and destruction policy and schedule.
        • Define retention periods by data category, applicable legal or business bases, deletion and anonymization protocols, and legal-hold exceptions.
        • Align retention requirements with Records of Processing Activities and applicable privacy notices.
        • Develop and implement operational privacy procedures and standard operating procedures across applicable jurisdictions.
        • Build a comprehensive Data Protection Impact Assessment and Privacy Impact Assessment framework.
        • Establish assessment triggers, templates, ownership requirements, review processes, and workflows.
        • Integrate privacy assessments into project planning, product development, procurement, and vendor onboarding.
        • Establish documented vendor privacy due-diligence procedures.
        • Develop standardized Data Processing Agreement templates and maintain a centralized agreement register.
        • Review and update Nova Biomedical’s Inter-Affiliate Data Transfer Agreement.
        • Establish appropriate governance, documentation, metrics, and reporting to measure the maturity and effectiveness of the global privacy program.

        Requirements

        • Juris Doctor degree from an accredited law school required.
        • Active membership in good standing with a U.S. state bar required.
        • Admission to the Massachusetts Bar preferred.
        • Minimum of eight years of relevant legal experience within a law firm, corporate legal department, or comparable environment.
        • Extensive knowledge of global privacy, data-protection, data-management, and cybersecurity laws and regulations.
        • In-depth knowledge of the General Data Protection Regulation and applicable U.S. federal and state privacy laws.
        • Practical experience developing, operationalizing, and maturing global privacy programs.
        • Experience managing Records of Processing Activities, data-subject-rights requests, breach response, impact assessments, retention schedules, cookie and consent management, vendor privacy reviews, and Data Processing Agreements.
        • Experience drafting, reviewing, and negotiating privacy notices, Data Processing Agreements, data-transfer agreements, Business Associate Agreements, and related privacy documentation.
        • Experience interpreting privacy requirements and translating legal obligations into practical business processes.
        • Experience advising on privacy concerns involving products, technology, security, data management, digital platforms, vendors, and business initiatives.
        • Experience partnering with Information Technology, Information Security, Governance, Risk and Compliance, and business teams.
        • Experience identifying, assessing,