Gender Identity, Personal Data and Social Networks: An analysis of the categorization of sensitive data from a queer critique

Costa, Ramon Silva; Gagliardi, Marília Papaléo; Torres, Livia Pazianotto

doi:10.1590/2179-8966/2022/61992i

person Ramon Silva Costa

schoolPontifícia Universidade Católica do Rio de Janeiro, Rio de Janeiro, Rio de Janeiro, Brasil. E-mail: ramonsilvacostta@gmail.com

0000-0003-4183-432X

person Marília Papaléo Gagliardi

schoolUniversidade de São Paulo, São Paulo, São Paulo, Brasil. E-mail: mariliagagliardi@msn.com

0000-0002-8389-2440

person Livia Pazianotto Torres

schoolFundação Getúlio Vargas, São Paulo, São Paulo, Brasil. E-mail: liviaptorres2@gmail.com

0000-0002-6028-6181

Ramon Silva Costa

PhD candidate in Law at Pontifícia Universidade Católica do Rio de Janeiro (PUC-Rio). Data Protection Lawyer at the Brazilian Network Information Center (NIC.br) binded to Brazilian Internet Steering Committee (CGI.br). Researcher at Legalite (Multidisciplinary center in legal informatics) integrated into the Law Department at PUC-Rio.

Marília Papaléo Gagliardi

Digital Rights Assistant at Article 19 Brazil. Master's student in International Law at Universidade de São Paulo (USP). Graduated in Law from the Pontificia Universidade Católica de São Paulo - PUC-SP (2018).

Livia Pazianotto Torres

Researcher at the Center for Studies in Public Sector Policy and Economics (CEPESP) at the FGV São Paulo Business School. Graduated in Law from the Universidade de São Paulo (USP).

The authors contributed equally to the writing of the article.

Category	Question
Sensitive data	What types of sensitive data does the network collect?
Transparency	Does the network have a privacy policy and terms of use written in understandable/less technical language? Does it describe well the data processing performed?
Non-discrimination	Does the network indicate any specific issues related to diversity and non-discrimination?
Rights of data subjects	Does the network indicate the rights of data subjects when using it and how to exercise them? How does it describe these guarantees?
Deletion	How does the network handle the data deletion issue? Does the network keep user data in the databases even after they delete the account?
Security	Does the network indicate security mechanisms for users' personal data? Which?
Gender data	Does the network collect data on gender? What are the options and collection methods?
Purpose	Does the network explicitly indicate the purposes for processing the gender data collected?
Legal bases	Does the network indicate the legal bases to process the gender data collected?
Sharing	Does the network indicate that it shares gender data with third parties? How does it justify sharing? Does it indicate the purpose of sharing and the third parties with whom it shares the data?

Sensitive data	Gender data	Non-discrimination	Purpose	Legal bases
To register, no sensitive data is collected. Said category of data is not included in the “data policy,” (FACEBOOK, 2021b). The company claims that profile data receive “special protections”.	Holders can only create a profile by providing data on gender which can be one of the options “female”, “male”, and “personalized”, selecting the appropriate treatment pronoun.	There are no non-discriminatory measures in the privacy policy. In the Community Standards (FACEBOOK, 2021h), the company states that hate speech cannot be published.	Data “with special protections” is used to “provide, customize and improve our products”, which includes “personalizing advertisements, offers, and other sponsored content”.	Gender identity data is collected through the legal basis of consent - but not in a specific and prominent way.

Security	Sharing	Deletion	Rights of data subjects	Transparency
The policy does not show security measures related to the flow of personal data. Manuals are provided for users to protect themselves on the network.	Personal data - including gender - is only shared with advertisers with the consent of the data subjects. If there is no consent, the data is shared anonymously.	Data storage occurs as long as it is useful to provide services and products or even account deletion, a determination that varies according to the case, with the purpose of the data, involvement of legal obligation, and nature of the information (FACEBOOK, 2021d and 2021e)	Provision of channels for inquiries about the LGPD (FACEBOOK, 2021f) - how to access, download and delete personal information, how to object to data processing - and contact the company's data protection officer (FACEBOOK, 2021g)	The terms are very descriptive, but some information is not detailed. The privacy policy makes no specific mention of gender identity.

Sensitive data	Gender data	Non-discrimination	Purpose	Legal bases
The platform can collect data on union membership if the holder wants to make it available on the network.	There is no field for gender declaration by the user in the Brazilian version. There is, however, the inference of gender through the platform.	There is a prohibition on content that spreads hatred and discriminatory actions against individuals or groups due to gender, among other aspects.	Gender data is inferred for ad targeting and can be entered to compose demographic information.	Gender identity data is collected through the legal basis of consent - but not specifically and prominently, based on legitimate interest.

Security	Sharing	Deletion	Rights of data subjects	Transparency
There is no processing that guarantees greater security, and the platform is not responsible for possible access and changes to the information sent.	There is no sharing of an individual member's inferred gender and age data with third parties. Data collected and shared is used as aggregated insights.	Deletes data after 30 days of account closure. However, data that does not identify the data subject is stored.	Delete, correct, revise and update information; delete the account; contact the Data Protection Officer.	The terms are very descriptive, but some information is not detailed. The privacy policy makes no specific mention of gender identity.

Sensitive data	Gender data	Non-discrimination	Purpose	Legal bases
Sensitive data such as ethnicity, race, sexual orientation, and religious beliefs are collected, as well as content such as photos and videos.	Data subjects can only create a profile by providing data on gender, which can be ‘man’, ‘woman’ or ‘other’, selected at their discretion	Community guidelines include the non-acceptance of hate speech of any kind, or violence and incitement to violence.	Gender data is basic login data, whose collection is intended for the operation of the service.	Gender identity data is collected through the legal basis of consent - but not in a specific and prominent way.

Security	Sharing	Deletion	Rights of data subjects	Transparency
Protects data from unauthorized access, alteration, disclosure, or destruction, including strict technical systems and encryption for users' photos and messages.	It shares data with service providers, service operation partners, other Match Group companies, and, in some cases, with legal authorities.	Retains data only as long as necessary for legitimate business interests. After deleting the account in the app, there is a period of three months to delete the data.	Delete, correct, revise and update information; whether or not to authorize access to the device; delete the account; uninstall; responsibility of the company.	The terms are very descriptive, but some information is not detailed. Besides, the privacy policy makes no specific mention of gender identity.

[TFN1] Source: Prepared by the authors.

Gender Identity, Personal Data and Social Networks: An analysis of the categorization of sensitive data from a queer critique

Identidade de Gênero, Dados Pessoais e Redes Sociais: Uma análise da categorização dos dados sensíveis a partir de uma crítica queer