Gender Identity, Personal Data and Social Networks: An analysis of the categorization of sensitive data from a queer critique

Identidade de Gênero, Dados Pessoais e Redes Sociais: Uma análise da categorização dos dados sensíveis a partir de uma crítica queer

Abstract

This article addresses the possibility of classifying gender identity as sensitive data, taking into consideration the parameters of Law 13.709/2018 and the queer theory. It presents a literature review and a documental analysis of terms from social networks. As a result, gender identity must be understood as sensitive data due to the vulnerability of non-cisgender people.

Keywords:
Gender Identity; Data Protection; Queer Theory

Resumo

Este artigo aborda a possibilidade de classificar a identidade de gênero como dado sensível, considerando os parâmetros da Lei 13.709/2018 e a teoria queer. Para isso, foram realizadas ampla revisão bibliográfica e análise documental de termos de redes sociais. Como resultado, tem-se que a identidade de gênero deve ser compreendida como dado sensível em virtude da vulnerabilidade de pessoas não cisgêneras.

Palavras-chave:
Identidade de gênero; Proteção de dados pessoais; Teoria Queer

Introduction¹

The Brazilian General Data Protection Law- Lei Geral de Proteção de Dados- (LGPD - Law 13.709/2018), in force since September 2020, determines the duties and obligations of agents that carry out operations for the processing of personal data. The law also consolidates a series of rights and guarantees of the natural persons to which the data refer - the so-called data subjects.

In the categorization of that data, the LGPD introduces a list of sensitive personal data (art. 5, item II) that has a distinct regime of obligations. In this list, the law mentions, objectively and explicitly, data on sexual life, not specifically addressing data related to gender identity, that is, the way in which the person expresses the gender with which he/she identifies. As this data is not simply related to biological factors, but mainly to personal, social, and cultural issues, the questions that guide this research arise: 1) How is data on gender identity processed and protected? 2) What are the possibilities and justifications for categorizing gender identity as sensitive data?

In this regard, classifying gender data as sensitive may be a necessary protective measure when we think about the Brazilian context, where systemic violence directed at the LGBTQIA+²population occurs, especially to people outside the cisgender conformation, susceptible to suffering more physical violence only because of their identity. According to surveys carried out by the National Association of Transvestites and Transsexuals (ANTRA), in 2020, 175 transvestites and transsexual women were murdered, a number that represented an increase of 41% compared to the previous year. Among the victims, 78% were black and 72% were sex workers (BENEVIDES; NOGUEIRA, 2021).

The inadequate processing of information about the gender of trans or non-binary³ people can seriously violate their personalities, creating contexts of discrimination for an already extremely marginalized population. Certain cases reveal how technologies and data processing can fuel violence based on the gender identity of vulnerable populations. Researchers Mariah Rafaela Silva and Joana Varon developed a study on the use of facial recognition in the Brazilian public sector and trans identities, in which they warn about the risks and discriminatory practices embedded in technology and data processing, which specifically affect the trans population. This scenario is aggravated by the lack of transparency, which makes it difficult to measure the harmful effects when assessing socioeconomic, racial, and territorial issues of trans people (SILVA; VARON, 2021).

Thus, given the normative silence, it is up to public and private agents, in the position of personal data controllers, to determine which interpretation to give to gender data. In this regard, interpretive alternatives are appropriate: (i) consider gender data as sensitive personal data, understanding that it is included in data about sexual life; (ii) consider it as sensitive personal data, understanding the list of art. 5 as an example and this information as autonomous and not related to sex life, starting from a contextual assessment, in accordance with art. 11, § 1st; and (iii) not considering it as sensitive personal data, considering the list of article 5 as exhaustive, and that the data is not covered by information about sexual life. Thus, the article explores which of the interpretations data controllers have been adopting in the country. Furthermore, the first and second interpretative possibilities are evaluated from the perspective of queer theory contributions.

In this context, this article seeks to analyze (i) how sensitive data is classified in the LGPD; (ii) how it would be possible to interpret data on gender identity as sensitive; and (iii) how personal data related to gender identity is handled by large companies. Therefore, the work presents an empirical investigation into the social networks Facebook, LinkedIn, and Tinder. Subsequently, interpretive ways are proposed to categorize gender identity as sensitive data, through the normative mechanisms offered by the LGPD, analyzed from a queer perspective.

1 Theoretical demarcation and methodological options

This research arose from the questioning about the limits and the strictness, or not, of the category of sensitive data brought by the LGPD, which does not consider data on gender or gender identity as sensitive. Therefore, this article gives special focus to non-cisgender people. Cisgenderity is based on a binary and biological pattern of man/male and woman/female This text focuses on other gender identities that do not correspond to this pattern, such as transsexuals, transvestites, agenres, non-binary, and fluid gender.

The research starts from a critique from the perspective of queer theory to the way in which the LGPD, as well as the socio-juridical structures that make up its field of implementation and applicability, are crossed and composed by heterocisnormativity⁴. This criticism explains, in part, the express absence of gender identity as sensitive data in the Brazilian law for the protection of personal data. The criticism, however, does not end with verifying the legislative omission, but continues with the need to interpret the normative dynamically, so that it allows tensioning the structural elements of universality and neutrality of the law, which discriminate against people non-compliant with normativity. Thus, the objective of this work is not to reduce queer criticism to a theorization, but rather to propose a perspective of analysis and confrontation of heterocisnormative structures in legal norms that directly affect the protection of identities that deviate from normativity in contexts of personal data processing.

In this regard, queer theory can be conceived as a critical path capable of examining how "laws, court decisions, theories of law, in their categories and presuppositions" are elements produced and reproduced from the systematic logic of sexist and heteronormative devices that comprise a binary view of gender, which perpetuates violence against and the marginalization of people who do not meet the gender standards restricted to the biological idea of cisgenderness (RAMOS, 2020, p. 3) (our translation).

Teresa de Laurentis was the first to use the term queer academically at a conference in 1990, in which she denounced the heterosexist character of studies on sexual diversity at the time (DE LAURENTIS, 1991). The choice of the term queer, which can be translated as “weird” and which was understood as “a curse that denoted abnormality”, serves to highlight a critique of the construction of normality, especially in terms of sexual and gender identity (MISKOLCI, 2009, p. 151) (our translation). However, the term was also redefined by social movements of LGBTQIA+ people, where the letter “Q” designates queer people, that is, those who do not meet gender norms.

Paul B. Preciado (2008) articulates the queer theory indicating that the norms of gender and sexuality have overcome a sense of separation between power and subjectivation. For the author, gender is an effect of discursive and visual practices that emanate from different institutional devices, such as the family, religion, school, the media, the biomedical, legal, and even cinema. The body, however, is not limited to a pre-discursive result, nor a purely biological fact, as it is also constituted in the relationship with the production of materials and technoscientific flows.

In this sense, a queer critique must involve issues that go beyond the constructions of identities that are categorized and marginalized and highlight the dehumanization effects of dissident bodies. Thus, discussing the protection of sensitive personal data must include a perspective on how data subjects cannot be neutralized as if their information locates them in the same social spaces and possibilities.

The articulation of queer criticism in law follows a process of contestation of universalist legal categories. Thus, the choice for the queer theoretical demarcation is an option for an analysis lens for the critique of law, especially to what concerns data protection legislation and its implementation, using data on gender identity as an analysis variable.

Thus, the search for empirical data appeared as a research demand, to understand whether the self-regulation of companies in the paths of data processing complies with the applicable legislation and if it would enable, by itself, the protection of gender identity as sensitive data.

Social networks were chosen because they are popular and because they make it possible to observe the interpretation of gender data in experiences with a great impact on the debate on data protection. Networks with different approaches were selected, namely: (i) Facebook as a social network for affinity and sociability purposes, with 130 million Brazilian users; (ii) LinkedIIn as a social network for work and professional contact, with 46 million users in Brazil; and (iii) Tinder as a network for relationships and encounters, with Brazil being the third country in the number of users (VOLPATO, 2021; ORAZEM, 2020; ALBACH, 2017).

The technique used to collect and evaluate research data was document analysis. The following documents were considered: (i) Facebook: Terms of Use, Data Policy; Ads Preferences, Help Center - LGPD Inquiries and Contacting the Data Protection Officer (DPO); (ii) LinkedIn: LinkedIn Help: Inferred Age or Gender on LinkedIn, LinkedIn Help: How LinkedIn uses demographic data, Preferences: Advertising Data and Contact LinkedIn Support; (iii) Tinder: Tinder's Terms of Use, Community Guidelines, and Security Center and Policy.

The analytical steps developed by researcher André Cellard (2008) were followed, who highlights the importance of a critical preliminary assessment of documents. Thus, we started from the assumption of documental complexity, considering its limitations as an important part of the analytical process. The elements extrinsic to the documents were observed, such as the social context in which they are produced, the authenticity and reliability of the texts taken from official platforms (CELLARD, 2008, p. 300-301). Then, categories based on core elements of the LGPD were created, structured in a question format, to facilitate the search and collection of data.

Box 1:
Categories/questions of document analysis.

Category	Question
Sensitive data	What types of sensitive data does the network collect?
Transparency	Does the network have a privacy policy and terms of use written in understandable/less technical language? Does it describe well the data processing performed?
Non-discrimination	Does the network indicate any specific issues related to diversity and non-discrimination?
Rights of data subjects	Does the network indicate the rights of data subjects when using it and how to exercise them? How does it describe these guarantees?
Deletion	How does the network handle the data deletion issue? Does the network keep user data in the databases even after they delete the account?
Security	Does the network indicate security mechanisms for users' personal data? Which?
Gender data	Does the network collect data on gender? What are the options and collection methods?
Purpose	Does the network explicitly indicate the purposes for processing the gender data collected?
Legal bases	Does the network indicate the legal bases to process the gender data collected?
Sharing	Does the network indicate that it shares gender data with third parties? How does it justify sharing? Does it indicate the purpose of sharing and the third parties with whom it shares the data?

• Source: Prepared by the authors.

The categories created were gathered in order to understand how privacy policies expose the functioning of data processing - especially personal data of gender. For this reason, the categories were developed based on key elements for an assessment of a company's suitability for the LGPD. The main objective of the study was to empirically verify whether this information is considered sensitive in the process of social networks. There are, however, limitations in document analysis, such as the insufficiency of some information in the documents, or the lack of transparency in certain points.

The research assumes that the categories listed can extract a partial analysis of the documental content, as other questions could be prepared. In addition, there is the limitation of the field cut, restricted to the chosen networks, and the timeframe, as the analysis was carried out between May and June 2021, making it possible for companies to modify these documents over time. The investigation, therefore, does not aim to exhaust the analytical possibilities and understands the limitations of research directed towards an article. Thus, it is demarcated that the study can be expanded or replicated to other fields aligned with this research.

2 How gender identity data is handled by Social Networks in Brazil

With the entry into force of the LGPD, several companies, including social networks, began to adapt their internal policies to the legislation, to guarantee their users' rights and avoid future sanctions by the National Data Protection Authority (ANPD). The method adopted by these companies to carry out the adjustment reflects how the LGPD is being applied and how personal data is being protected. It also reflects the level of discussion about contexts not explored by the law, such as the data on gender identity. The following topics bring the results observed in the documents relating to the privacy policy and data processing of Facebook, LinkedIn, and Tinder.

2.a Facebook

Facebook is now one of the five largest companies in the US Silicon Valley. Researcher Shoshana Zuboff (2020) points out that the network is related to the dissemination of the business model based on the processing of personal data to deepen the ability to influence the choices of its users with targeted advertisements and publicity. Currently, the company dominates a large portion of the digital market (e.g. WhatsApp and Instagram), a fact that has been stimulating several discussions in the field of data protection (MCLAUGHLIN; KERN, 2021).

According to Facebook (2021a), its mission is to empower people to build communities and bring the world together, with security and privacy protection being one of its principles. Recently, the company reached the mark of 3 billion active users around the (FACEBOOK, 2021a), with Brazil being the 4th country with the most users on the platform, with approximately 120 million active accounts (SILVA, 2020a), which is equivalent to more than half of the Brazilian population. To register on Facebook, the information required is: first name, last name, email, date of birth, and gender.

Box 2:
Facebook Results 1.

Sensitive data	Gender data	Non-discrimination	Purpose	Legal bases
To register, no sensitive data is collected. Said category of data is not included in the “data policy,” (FACEBOOK, 2021b). The company claims that profile data receive “special protections”.	Holders can only create a profile by providing data on gender which can be one of the options “female”, “male”, and “personalized”, selecting the appropriate treatment pronoun.	There are no non-discriminatory measures in the privacy policy. In the Community Standards (FACEBOOK, 2021h), the company states that hate speech cannot be published.	Data “with special protections” is used to “provide, customize and improve our products”, which includes “personalizing advertisements, offers, and other sponsored content”.	Gender identity data is collected through the legal basis of consent - but not in a specific and prominent way.

• Source: Prepared by the authors.

In the policy, “data with special protections” is mentioned for “providing, customizing and improving our products”, which includes providing personalized experiences to users and improving Facebook's products, purposes about which there is little information. It also comprises “selecting and customizing advertisements, offers and other sponsored content (...)”, relating to Facebook's business model. According to the company, advertisers carry a list of information about the target audience they want to reach, and Facebook matches the ads to users' timelines.

For this purpose, the company makes available tools (FACEBOOK, 2021c) to control personal data, allowing users, for example, to choose whether some data can be used to target ads. However, there is no way to configure the use of personal data on gender to target ads. Also on this link, Facebook draws attention to the fact that, despite the settings made available, advertisers will still be able to reach the user “by choosing categories related to age, gender, location (...)”. Therefore, it is concluded that Facebook uses personal data of gender to target ads, with no choice for the user.

Box 3:
Facebook Results 2.

Security	Sharing	Deletion	Rights of data subjects	Transparency
The policy does not show security measures related to the flow of personal data. Manuals are provided for users to protect themselves on the network.	Personal data - including gender - is only shared with advertisers with the consent of the data subjects. If there is no consent, the data is shared anonymously.	Data storage occurs as long as it is useful to provide services and products or even account deletion, a determination that varies according to the case, with the purpose of the data, involvement of legal obligation, and nature of the information (FACEBOOK, 2021d and 2021e)	Provision of channels for inquiries about the LGPD (FACEBOOK, 2021f) - how to access, download and delete personal information, how to object to data processing - and contact the company's data protection officer (FACEBOOK, 2021g)	The terms are very descriptive, but some information is not detailed. The privacy policy makes no specific mention of gender identity.

• Source: Prepared by the authors.

Despite provisions stating that Facebook only shares identified data with the consent of users, the company accumulates scandals involving improper sharing of personal data. The best-known case is that of political marketing consultancy Cambridge Analytica, sanctioned by the National Consumer Protection Secretariat (Senacon) (RESENDE, 2019). But there are also cases under investigation by the same Secretariat, of sensitive data illegally received (such as heart rate and menstrual cycle) by a partner application and data sharing with the WhatsApp instant messaging network (BUCCO, 2021) In common, in addition to dealing with improper sharing, all cases involve the use of sensitive data to target ads.

2.b LinkedIn

LinkedIn defines itself as a platform for professionals, whose purpose is to promote connections, acquire work opportunities, establish and strengthen professional relationships, and even for business purposes. According to data released in 2020, the site had 46 million users in Brazil (ÉPOCA NEGÓCIOS, 2020) and 738 million users around the world (GREENHALGH, 2021), with an average of 100,000 new profiles created daily ( SILVA, 2020b).

LinkedIn requires little information to create a profile, such as: name, email address and/or mobile device number, and password. Still, the platform infers gender data about its users as stated in LinkedIn's privacy policy (LINKEDIN, 2021f). According to the platform, the inference is based on the name or pronouns used when users recommend each other's competences (LINKEDIN, 2021c). Therefore, it is important to understand how gender data is processed.

Box 4:
LinkedIn Results 1.

Sensitive data	Gender data	Non-discrimination	Purpose	Legal bases
The platform can collect data on union membership if the holder wants to make it available on the network.	There is no field for gender declaration by the user in the Brazilian version. There is, however, the inference of gender through the platform.	There is a prohibition on content that spreads hatred and discriminatory actions against individuals or groups due to gender, among other aspects.	Gender data is inferred for ad targeting and can be entered to compose demographic information.	Gender identity data is collected through the legal basis of consent - but not specifically and prominently, based on legitimate interest.

• Source: Prepared by the authors.

It is noteworthy that, as to the purpose, the way in which information about gender is reflected in targeted advertisements is not mentioned. In the account settings area, it is only informed that the user will continue to see the same number of ads, but these will be “less relevant” (LINKEDIN, 2021d). It is possible to stop targeting ads based on gender inference if the user chooses to do so - which does not prevent gender inference itself.

Regarding the “voluntary demographic information of self-identification”, it is possible to identify, in the individual's profile configurations, with the “female”, “male”, “other gender identity” or “prefer not to declare” gender. This data is not displayed and, depending on the platform, is used for statistics, news, announcements, and personalized content (LINKEDIN, 2021e). Although there is the user's consent to fill in these "demographic" fields, the platform's inference about the user's gender happens regardless of his/her will.

The platform has a binary perception of gender issues. This is inferred from the analysis of reports generated annually, such as the “Gender Insights Report” (LINKEDIN, 2019), which demonstrates how women and men get involved in jobs in different ways. The possibility of the user identifying himself with non-binary gender identity was only considered by LinkedIn in March 2021, when the network allowed the inclusion of pronouns in the profiles created - including neutral pronouns. That modality was only incorporated in five countries: the United States, Great Britain, Sweden, Canada, and Ireland (GREENHALGH, 2021).

The lack of perception about a population that is outside the normative cisgender scope by the platform is worrying, considering that, in Brazil, 38% of companies have restrictions to hire LGBTQIA+ (SANTO CAOS, 2015), 90% of trans and transvestite women have prostitution as the source of income and subsistence (BENEVIDES; NOGUEIRA, 2021, p. 44) and that, during the COVID-19 pandemic, the unemployment rate of the trans population was 20.47%, higher within the LGBTQIA+ community itself, whose average unemployment was 17.5% (VOTELGBT; BOX1824, 2021). Other aspects were evaluated to characterize the level of protection and guarantees in the network, as shown in the table below.

Box 5:
LinkedIn Results 2.

Security	Sharing	Deletion	Rights of data subjects	Transparency
There is no processing that guarantees greater security, and the platform is not responsible for possible access and changes to the information sent.	There is no sharing of an individual member's inferred gender and age data with third parties. Data collected and shared is used as aggregated insights.	Deletes data after 30 days of account closure. However, data that does not identify the data subject is stored.	Delete, correct, revise and update information; delete the account; contact the Data Protection Officer.	The terms are very descriptive, but some information is not detailed. The privacy policy makes no specific mention of gender identity.

• Source: Prepared by the authors.

While users can contact LinkedIn's Data Protection Officer (LINKEDIN, 2021b) directly to request clarification about themselves, as well as Support for clarification on the privacy policy (LINKEDIN, 2021a), the pages presented are in English, which may imply a barrier for data subjects to exercise their rights.

2.c Tinder

Tinder is a relationship network created in 2012 in the United States. The platform works from the geolocation of users and aims to create links and contacts between profiles, being especially used through an application (app). The network has millions of users worldwide. In Brazil alone, it already had ten million users in 2014, equivalent to 10% of the total users in the world⁵ (JUNQUEIRA; VENTURA, 2019). Tinder users are looking for matches (combinations), made between profiles when there is a mutual approval between them through what is called a ‘like’.

When creating a Tinder profile, the login options are a Google email, Facebook profile, or phone number. Data such as the gender and age of the user is required. The network offers the gender options man, woman, and “more”, in which other identities can be freely included. The user chooses whether to display the gender in the profile. Tinder provides a text explanation of the “more” option as a way to include diverse gender identities. The matter is also clarified through the speech of people who represent these identities in a video on the platform's page⁶. This is an inclusion tool, as it provides explanations in text and video, in accessible language, and with representative communicators. However, the video was produced in English, which limits the information for Brazilian users.

The network, however, receives complaints from trans people who have their profiles banned without justification or for a generic violation of community guidelines. In this regard, the company responded that it does not ban users due to their gender identity; it is a complex context in which users report the accounts of trans people. The network recognized that trans people face challenges and said it is working to improve their practices, with the support of specialized organizations (MARÇAL, 2020). In addition, Tinder provides a contact email where people can complain if they believe their profiles have been unfairly banned.

In this context, at first, it is important to demarcate how Tinder handles sensitive data, for what purpose and how it collects gender data and whether it has content on the principle of non-discrimination in its terms.

Box 6:
Tinder Results 1.

Sensitive data	Gender data	Non-discrimination	Purpose	Legal bases
Sensitive data such as ethnicity, race, sexual orientation, and religious beliefs are collected, as well as content such as photos and videos.	Data subjects can only create a profile by providing data on gender, which can be ‘man’, ‘woman’ or ‘other’, selected at their discretion	Community guidelines include the non-acceptance of hate speech of any kind, or violence and incitement to violence.	Gender data is basic login data, whose collection is intended for the operation of the service.	Gender identity data is collected through the legal basis of consent - but not in a specific and prominent way.

• Source: Prepared by the authors.

Gender information can also be inferred from user interactions and content, or by connecting to other networks (e.g. Facebook and Instagram). When explaining the use of automatic decision-making performed by the network algorithm, Tinder indicates that it uses gender and other data to feed the matches algorithm, but does not use information such as race, ethnicity, income, and religion. It is noteworthy that the network also handles data from conversations between users, as well as the content that users publish, as part of the operation of services (TINDER, 2021) However, the failure to obtain specific and detailed consent on gender data indicates that the company still does not perceive this data as sensitive, which characterizes an opening for violations. Other aspects were evaluated to characterize the level of protection and guarantees in the network, as shown in the table below.

Box 7:
Tinder Results 2.

Security	Sharing	Deletion	Rights of data subjects	Transparency
Protects data from unauthorized access, alteration, disclosure, or destruction, including strict technical systems and encryption for users' photos and messages.	It shares data with service providers, service operation partners, other Match Group companies, and, in some cases, with legal authorities.	Retains data only as long as necessary for legitimate business interests. After deleting the account in the app, there is a period of three months to delete the data.	Delete, correct, revise and update information; whether or not to authorize access to the device; delete the account; uninstall; responsibility of the company.	The terms are very descriptive, but some information is not detailed. Besides, the privacy policy makes no specific mention of gender identity.

• Source: Prepared by the authors.

Although Tinder indicated security precautions, in 2020, Senacon notified the platform for selling users' data to other companies to improve the efficiency of advertisements (LARA, 2020). In this regard, the network's privacy policy indicates that it can share personal data, including gender, to develop and provide advertising (TINDER, 2021c).

Among the rights of data subjects, uninstalling interrupts data processing, but the network continues to store the mobile identifier associated with the device. Data subjects can also call the ANPD (National Data Protection Authority) for complaints. Furthermore, the three-month timeframe for deleting the data may not be met due to technical limitations (TINDER, 2021c).

3 Gender identity as sensitive data: interpretations for anti-discrimination protection

LGPD, in its art. 5, item II, indicates that sensitive personal data is personal data on racial or ethnic origin, religious belief, public opinion, affiliation to union or religious, philosophical or political organization, data relating to the health or “sex life”, genetic or biometric data. Since the law is risk regulation, the creation of this category implies that agents who process sensitive personal data consider their operations as riskier in relation to the fundamental rights and freedoms of data subjects, thus requiring greater security and protection of the flows of said data (QUELLE, 2017; ZANATTA, 2017; BIONI; LUCIANO, 2019).

It is noteworthy that the creation of the sensitive data category is part of a pragmatic observation process about the different effects caused by the processing of said data in relation to others. Thus, the very selection of which data would be sensitive demonstrates that the circulation of certain information can lead to greater harm to its data subjects, in a given social configuration (DONEDA, 2019, p. 143). The simple formation of profiles based on sensitive personal data can lead to discrimination due to several factors. Among them, it is possible to mention the fact that personal data, apparently not "sensitive", can become sensitive if it contributes to the development of a profile, or even in contexts where the individual sphere itself can be violated when the person belongs to a stigmatized group or is associated with negative characteristics and interpretations (RODOTÀ, 2008), which is the case of non-cisgender populations.

However, it is not clear in the LGPD whether the data considered sensitive consists of an exhaustive or exemplary list. Likewise, there is no official guidance from ANPD (National Data Protection Authority) and legislation regarding the possibility or the obligation to understand gender identity as data relating to sexual life. Thus, this research raised data and discussions to reflect on the categorization of data on gender identity as sensitive data. Given the absence of specific regulation, the main objective is to explore how large social networking companies, which occupy different aspects of everyday life: social, romantic, family and work relationships, are self-regulated. As the analysis of the networks revealed, companies do not show in their respective policies the way they interpret and, therefore, process personal gender data. The global analysis of the documents allows us to infer that such data is not classified by them as sensitive information, which indicates the need for clarification by the regulatory authority on this matter.

This classification would place companies that process gender identity data with more significant obligations to protect such data. Furthermore, it would make processing based on the legal hypothesis of legitimate interest impossible, in addition to limiting the use of the legal basis of consent, which, for sensitive data, must be provided in a specific and prominent manner, for specific purposes, as provided for in art. 11, I of LGPD. Given this context, it is necessary to think about the possibilities of interpretation to classify personal gender data as sensitive.

Among the possibilities, there are two options capable of including gender identity as sensitive information: (i) the possibility of including gender identity in an interpretation of sensitive data regarding sexual life, as provided for in art. 5th, II; or (ii) the exercise of a contextual interpretation, supported by art. 11, § 1, which establishes the regulation as sensitive data to any processing of personal data that reveals sensitive personal data and that may cause damage to the data subject.

Regarding the definition of data referring to sexual life, it is evident that the legislator's option for a generic term is problematic, as it opens disproportionate margins for the interpretation and application of the law. This is due to the fact that while some data controllers may opt for inclusive perceptions about sexual diversity, others may restrict the spectrum of application of a more guaranteeing interpretation. Gender identity is an example of this issue. In a more restricted interpretation, gender does not comprise information about a person's sexual life, and if we understand non-cisgender identities from the same perspective, the result is the exclusion of data on gender identity from the sensitive data category.

However, based on the queer contribution, Daniel Borrillo (2011, p. 30) emphasizes that the binary sexual division between man/male and woman/female complements heterocisnormative conceptions of sex, gender, and sexuality. Thus, when thinking about the components of social perception about sexual life, gender identity can also be understood as a sexual characteristic. It is an identity, it is not linked to people's sexual orientation or exercise of sexuality, but it assigns them a location in the sociocultural constructs of gender and, therefore, a position in the sexual division, even if it does not belong to normativity.

In this regard, the interpretative proposal of gender identity as data referring to sexual life and, therefore, belonging to the category of sensitive data, is a way to protect people, especially non-cisgender people, considering that said group falls into a highly discriminatory social context. Information on non-normative identities increases the vulnerability of these people and the potential harm in cases of inadequate data processing. This does not exclude the possibility of understanding gender as sensitive information, even when related to binary sexual division, as is the case with information on race, which does not go through a division based on distinctions of privilege or social oppression. Furthermore, the interpretation of gender identity as information on sexual life provides immediate application of the sensitive data regime, restricting the possibilities to process this type of data.

The idea of gender aligned with aspects of sexual life is diffused in queer theory, which subverts and challenges the normativity of bodies. Judith Butler (1990) stresses the binary construction of gender, demarcating that it is focused on sexual relations, the body not being naturally sexual, but marked by a gender identity produced from culturally produced performativity. Thus, gender identity does not determine our behaviors, but we conceive identity by the behavioral patterns we reproduce (BUTLER, 2020, p. 242-243). This perspective strengthens the perception that gender is an expressive path in the construction of the sexual sphere, including non-normative identities that subvert binary logics.

In terms of Brazil, thinking about gender and sexuality requires a careful look at a society that includes a perspective on the distribution of violence. Jota Mombaça (2016) explains that vulnerable populations such as people who do not obey cisnormativity receive a greater share of violence in the Brazilian social structure. That is to say, to be a non-cisgender person is to become a less human target in a racist, sexist, classist, and lgbtphobic society.It is important to highlight that not recognizing one’s gender, or misgendering a person, even if in the context of a social network, reinforces the idea that the space that this person occupies, the society that they find themselves into, do not consider their person’s gender real. This implies rejection, impacts their self-esteem and confidence, lack of authenticity and increases one’s perception of being socially stigmatized (KEYES, 2018).

Skinner-Thompson (2021) reveals dimensions of what he calls “privacy on the margins,” referring to the historical and sociocultural constructs that underpin the relationship between surveillance and privacy for vulnerable populations. The researcher debates the possibilities of security in the private life and freedom of LGBTQIA+ people, emphasizing that historically non-heteronormative people face surveillance contexts and social restrictions. In this sense, the improper treatment of information about this population tends to increase the discriminatory context. In other words, surveillance of LGBTQIA+ people is a historical and structural process of discrimination and categorization of people based on their identities and sexual practices. This process affects the ways in which these people are treated, therefore, information about their lives can be used in a negative way, reflecting perceptions that already marginalize them in society.

At this juncture, thinking about the protection of data on gender identity reveals the need to assess the social factors surrounding this information, as well as the discriminatory and harmful potential of its processing, whether in a private sense, since it is evident that the identity of gender is a very personal aspect, whether in terms of collective effects, as non-cisgender people already suffer systematic and structural violence for not meeting a normative gender expectation.

Thus, gender identity is information with significant discriminatory potential, and it can be used to exclude people who already suffer violence and limitations in the most diverse social sectors, such as education, health, and the labor market. In this scenario, the inadequate processing of gender data in social networks, for example, can translate into a significant collective impact, considering the context of sharing with other companies and the enormous capacity of popular social networks to collect this information from vulnerable groups.

This understanding is justified because the category of sensitive data comprises personal data "especially susceptible to use for discriminatory purposes, such as stigmatization, exclusion or segregation", which may cause violations of people's dignity, personal identity, and privacy (KONDER, 2019, p. 455) (our translation).Therefore, it is possible to understand that there is no exhaustive list of sensitive data in the LGPD, as such data is classified according to the level of harm it presents in each processing.

Paul Quinn and Gianclaudio Malgieri (2020, p. 29-30) analyze the European context of the discussion on sensitive data protection and argue about the need to rethink the approach that is used for this category of data. The authors thus propose a hybrid approach, taking into account the purpose of the processing of sensitive data. For them, personal data should be considered sensitive if the controllers' intention is to process or discover sensitive information or if it is reasonably foreseeable that such data could be used to reveal or infer sensitive aspects. This formulation is defended by the authors as a form of balance for analyzing the context of sensitive data processing, avoiding disproportionate interpretations. In this way, the concept of sensitive data remains viable, and a real level of protection is provided to data subjects who may be in a vulnerable position and at risk of discrimination and mitigation of other fundamental rights.

However, just as European and Brazilian legislation does not contemplate peaceful concepts on sensitive data, the interpretation of this category of data and the way in which the controllers will use it cannot be relativized to the point of allowing infringing and improper treatment. In this sense, thinking about the social context of sensitive information is to increases the defense of the subject’s fundamental rights. In other words, some information needs to be treated more rigorously because the social context has a strong impact on the possibilities of discrimination in its treatment. Therefore, sensitive data must be processed only when necessary and in accordance with specific purposes and appropriate legal bases.

Thus, assuming that certain information has greater potential to be treated in a discriminatory manner, another possible interpretative way to classify gender identity as sensitive data is the contextual evaluation of its processing. Art. 11, § 1, of the LGPD, brings the possibility of applying the sensitive data regime to data that, even not originally understood as sensitive, or not belonging to the options provided for in art. 5, II, is characterized as such, according to the context of processing. However, there is a discussion about the presence of damage when classifying a piece of data as sensitive. Such a link between damage and sensitivity restricts the scope of the application of art. 11, since it is difficult for the data subject to concretely prove the damage. In addition, the harmful effects are, to a large extent, reflected in the collective and private sphere of the data subjects (MULHOLLAND, 2020, p. 131).

When we look at the data on gender identity on social networks, what we have is an activity of little transparency about the way this data is inferred and used by companies, in addition to the provisions of privacy policies. This is due to the fact that these companies manage large personal databases, carrying out an extensive profile of the personality of their users. This is because social networks are part of the process of socioeconomic organization called “surveillance capitalism”, in which platforms yield profits by translating personality data into behavioral data (ZUBOFF, 2020) (our translation). This market is stimulated by persuasion initiatives introduced in the networks, which intend to make predictions about our future steps and, therefore, increase the chances of creating profitable trades. About this supposed predictability, however, many questions remain. After all, if algorithms only use patterns identified in the past to predict the future, they miss out on a series of new gender identities that can be recognized and normalized over time.

The very act of inferring gender data, it is important to emphasize, implies a paradox of privacy. This is because analyzing this data without considering the user's will implies accessing information that people might not want to share. In order to deal with this information, or seek to correct it (in the case of misgendering), users find themselves obliged to provide even more additional information, disclosing more data or more detailed information about themselves (CUSTERS 2013).Thus, gender identity is information that, when processed illegally and abusively, can generate private and collective damage. Therefore, interpreting this data as sensitive also includes a perspective that any sensitive data, when processed outside the legal hypotheses of art. 11, I, II, of LGPD, “will always generate damages of a very personal nature for violation of the rights of privacy, freedom or identity, fundamentals of data protection”. Thus, the damage would be in re ipsa, without the need for proof of other legal consequences, which does not remove the possibility of a person claiming the existence of concrete damage to their personality (MULHOLLAND, 2020, p. 131-132) (our translation).

The proposals for interpreting gender identity as sensitive data presented in this work especially consider the non-cisgender population, considering that sexual and gender diversity brings together a context of various types of violence. However, the interpretations aim, in the first place, to ensure that the legislation fulfills its objective of a broad protection of the natural person against violations of their personal data, with the category of sensitive data having greater protective robustness, in line with the principle of non-discrimination established by law. Thus, having identified the great harmful potential of the processing of gender identity data, what remains for the processes of adjustment to the LGPD is to follow the provisions on the sensitive data regime, added to the legal basis, which advocates the development of personality and human dignity in its art. 2, VII.

In this regard, in LGPD implementation processes, data on gender identity must be understood as sensitive, either by its insertion in the term "sexual life" provided for in the list of sensitive data in the LGPD, or by a contextual assessment that gives it the elements for configuration as sensitive data, namely: (i) very personal information; (ii) discriminatory potential; and (iii) harmful potential. Both interpretations follow the perception that the discriminatory effects are not in the data itself, but in its use (DONEDA, 2019, p. 144). However, certain types of information configure a greater context of vulnerability for its data subjects.

Thus, the proposed interpretations establish possibilities to expand the LGPD's tutelage and include a panorama for data subjects who face social contexts of greater vulnerability. In this scenario, injustices and demands related to gender and sexual life put the right to anti-discrimination to the test, while challenging and developing it. That reveals the need for a “juridical-scientific methodological stance, marked by theoretical concern with the understanding of existing legal categories and their relationship with gender and sexuality” (RIOS, 2020, p. 1335) (our translation). Therefore, the exercise of interpreting the LGPD beyond the norm and normativity was based on the queer perspective, as a way of stressing the category of sensitive data, including human and identity factors still little seen by lawmakers and, as also observed in empirical research, by companies in their privacy and data protection policies.

4 Conclusion

As shown, the purpose of the LGPD was to provide autonomy to data subjects regarding their personal information. One of the principles of this new law is non-discrimination in order to safeguard data subjects from exposure to vexatious situations or greater vulnerability, certain data is determined to be sensitive data - which should be processed with greater caution.

Among sensitive personal data, there is the term “sexual life”, which, due to its vagueness, does not make explicit whether it also protects data on gender identity. This normative lack is related to a culture of marginalization of debates about gender diversity. As a consequence, express norms are not produced to protect identities that do not behave in a binary gender perspective - which is divided by the male/female parallel and does not correspond to the identity diversity of the population. This scenario contributes to the consolidation of contexts of discrimination, vulnerability, and violence for non-cisgender people.

However, it is possible to understand that data on gender can be considered sensitive data, both from an extensive interpretation of the term "sexual life", in article 5, II, LGPD, as from the very definition of the term sensitive data (as data that exposes data subject to greater vulnerability) in line with the interpretation of article 11§1, LGPD, which leads to the interpretation that the list of sensitive personal data is not, per se, exhaustive. These interpretations are aligned with the context of vulnerability, linked to issues of gender identity, which contribute to the marginalization of people, depending on their identification. The understanding of gender data as sensitive data is particularly relevant in Brazilian society, where there is systemic violence directed at the population that does not fit the normative cisgender standard.

Despite these considerations, the digital platforms analyzed in this research do not process gender data with due care, either because they are not transparent about the processing performed, or because they do not guarantee sufficient security measures, or because they carry out the activities regardless of consent users, through inferences made in an unknown manner by the data subjects.

Among the networks used, there are good practices that deserve to be highlighted. Tinder, for example, deals with the issue of information about gender identity through a text and video explanation, in accessible language, and with representation. Furthermore, this network, as well as Facebook, allows the inclusion of all gender identities and expressions in the user's profile, which represents that they understand the plurality of possible gender identities. LinkedIn, in turn, has an easy-access channel to the Data Protection Officer (DPO), which makes it possible to implement the rights of the data subjects more quickly, especially with regard to possible violations.

The networks, however, have a series of aspects that need to be revised. Tinder is silent about matching or recognizing gender data as sensitive. Facebook and LinkedIn categorize gender data in the same data segment considered sensitive by the LGPD, but do not process the data differently, remaining irregular. Still, it is highlighted that all studied networks lack a policy that is concerned with issues related to gender identity and how these issues can affect their users.

Thus, even though the LGPD has brought a series of innovations and guarantees to data subjects, its wording on sensitive data makes room for companies to continue dealing with gender data of the trans or non-binary population as if it were information that does not deserve specific care, regardless of the potential harm it may cause. Thus, the role attributed to queer theory in this work was precisely the contestation of a non-inclusive normative structure, which did not observe the protective and anti-discriminatory potential that the express inclusion of gender identity in the text of the law would have. Even so, the dynamic interpretation of the LGPD makes it possible to articulate criticisms capable of broadening the protection provided for in the legislation and emphasizing an inclusive data protection culture, capable of overcoming the universal and normative construction of the actual data subject.

Therefore, it is concluded that the analysis of legislation and empirical research reveals that neither the legislator nor the social networks considered gender diversity in the definition of legal norms. This lack of concern with gender identity empirically confirms, for the domain of personal data protection, what queer theory indicates more generally: the law starts from a heterocisnormative perspective and ignores gender diversity. The proper interpretation of the LGPD, considering gender data as sensitive data, can overcome this limitation and foster a data protection culture that pays attention to human diversity, in accordance with constitutional principles.

Bibliographic references

• ALBACH, Gabriela. Brasil é o terceiro país em número de usuários no Tinder no mundo. A Tarde, São Paulo, August 3, 2017 Available at:https://atarde.uol.com.br/brasil/noticias/1882824-brasil-e-o-terceiro-pais-em-numero-de-usuarios-no-tinder-no-mundo Accessed on: June 10, 2021
  » https://atarde.uol.com.br/brasil/noticias/1882824-brasil-e-o-terceiro-pais-em-numero-de-usuarios-no-tinder-no-mundo
• BIONI, Bruno; LUCIANO, Maria. O princípio da precaução na regulação de inteligência artificial: seria as leis de proteção de dados o seu portal de entrada? In: FRAZÃO, Ana; MULHOLLAND, Caitlin. Inteligência artificial e direito: ética, regulação e responsabilidade. São Paulo: Thomson Reuters Brasil, 2019. p. 207-232.
• BENEVIDES, Bruna; NOGUEIRA, Sayonara. Dossiê dos assassinatos e da violência contra travestis e transexuais brasileiras em 2020. São Paulo: Expressão Popular, ANTRA, IBTE, 2021.
• BORRILLO, Daniel. Por una Teoría Queer del Derecho de las personas y las familias. Revista Direito, Estado e Sociedade, n. 39, 2011, p. 27- 51.
• BRASIL. Lei nº 13.709, de 14 de agosto de 2018- Lei Geral de Proteção de Dados Pessoais (LGPD). Available at: http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm Accessed on: June 01, 2021
  » http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm
• BUCCO, Rafael. Senacon dá 15 dias para facebook e whatsapp explicarem partilha de dados. Tele Síntese, February 5, 2021 Available at:https://www.telesintese.com.br/senacon-da-15-dias-para-facebook-e-whatsapp-explicarem-partilha-de-dados/. Accessed on: July 19, 2021
  » https://www.telesintese.com.br/senacon-da-15-dias-para-facebook-e-whatsapp-explicarem-partilha-de-dados/.
• BUTLER, Judith. Problemas de gênero: feminismo e subversão da identidade. 20 ed. Rio de Janeiro: Civilização Brasileira, 2020.
• CELLARD, André. A análise documental. In: POUPART, Jean et al. (org.). A pesquisa qualitativa: enfoques epistemológicos e metodológicos. Petrópolis: Vozes, 2008. p. 295-317.
• CUSTERS, Bart. Data Dilemmas in the Information Society: Introduction and Overview. Discrimination and Privacy in the Information Society. Studies in Applied Philosophy, Epistemology and Rational Ethics, vol 3. Berlin, Heidelberg: Springer, 2013.
• DE LAURENTIS, Teresa. Queer Theory, Lesbian and Gay Studies: An Introduction. Differences: A Journal of Feminist Cultural Studies, v. 3, n. 2, Special Issue, summer, 1991, p. 3-18.
• DONEDA, Danilo. Da privacidade à proteção de dados pessoais: fundamentos da Lei Geral de Proteção de Dados. São Paulo: Thomson Reuters Brasil, 2019.
• FACEBOOK. Company Info. Available at:https://about.facebook.com/company-info/. Accessed on: June 15, 2021a.
  » https://about.facebook.com/company-info
• FACEBOOK. Política de Dados. Available at: https://www.facebook.com/privacy/explanation. Accessed on: June 15, 2021b.
  » https://www.facebook.com/privacy/explanation.
• FACEBOOK. Preferências de anúncios. Configurações de anúncio. Available at:https://www.facebook.com/adpreferences/ad_settings Accessed on: June 15, 2021c.
  » https://www.facebook.com/adpreferences/ad_settings
• FACEBOOK. Padrões da Comunidade, Segurança. Available at: https://www.facebook.com/communitystandards/safety Accessed on: June 15, 2021d.
  » https://www.facebook.com/communitystandards/safety
• FACEBOOK. Central de Segurança. Available at:https://www.facebook.com/safety Accessed on: June 15, 2021e.
  » https://www.facebook.com/safety
• FACEBOOK. Consultas da Lei Geral de Proteção de Dados (“LGPD”). Available at: https://www.facebook.com/help/contact/789708118270163 Accessed on June 15, 2021f.
  » https://www.facebook.com/help/contact/789708118270163
• FACEBOOK. Entrar em contato com o encarregado da proteção de dados (DPO). Available at: https://www.facebook.com/help/contact/710375233121010 Accessed on June 15, 2021g.
  » https://www.facebook.com/help/contact/710375233121010
• FACEBOOK. Diretrizes da comunidade. Discurso de ódio. Available at:https://www.facebook.com/communitystandards/hate_speech Accessed on: June 22, 2021h.
  » https://www.facebook.com/communitystandards/hate_speech
• GREENHALGH, Hugo. LinkedIn embraces global trend for gender pronouns option on profiles. Reuters, March 30, 2021. Available at: https://www.reuters.com/article/us-tech-lgbt-linkedin-trfn-idUSKBN2BM2EX Accessed on: June 5, 2021
  » https://www.reuters.com/article/us-tech-lgbt-linkedin-trfn-idUSKBN2BM2EX
• JUNQUEIRA, Daniel; VENTURA, Layse. Tinder: história, dicas e principais recursos do app de encontros. Olhar Digital, June 9, 2021 Available at: https://olhardigital.com.br/2019/01/18/internet-e-redes-sociais/tinder-historia-dicas-e-principais-recursos-do-app-de-encontros/. Accessed on: June 14, 2021
  » https://olhardigital.com.br/2019/01/18/internet-e-redes-sociais/tinder-historia-dicas-e-principais-recursos-do-app-de-encontros
• KEYES, Os. The misgendering machines: Trans/HCI implications of automatic gender recognition. Proceedings of the ACM on Human-Computer Interaction. Vol 2, issue CSCW, New York, US: Association for Computing Machinery, 2018. (pp. 1-22).
• KONDER, Carlos Nelson. O tratamento de dados sensíveis à luz da Lei 13.709/2018. In: TEPEDINO, Gustavo; FRAZÃO, Ana; OLIVA, Milena (Coords). Lei Geral de Proteção de Dados Pessoais e suas repercussões no Direito Brasileiro. 1 ed. São Paulo: Thomson Reuters Brasil, 2019. p. 445-463.
• LARA, Mahila. Governo notifica Tinder e Grindr por vender dados pessoais de usuários. Poder 360, 15 jan. 2020. Available at: https://www.poder360.com.br/midia/governo-notifica-tinder-e-grindr-por-vender-dados-pessoais-de-usuarios/. Accessed on: June 16, 2021
  » https://www.poder360.com.br/midia/governo-notifica-tinder-e-grindr-por-vender-dados-pessoais-de-usuarios
• LINKEDIN anuncia a lista Top Voices do Brasil em 2020. ÉPOCA NEGÓCIOS, nov. 2020. Available at: https://epocanegocios.globo.com/Carreira/noticia/2020/11/linkedin-anuncia-lista-top-voices-do-brasil-em-2020.html Accessed on: July 19, 2021
  » https://epocanegocios.globo.com/Carreira/noticia/2020/11/linkedin-anuncia-lista-top-voices-do-brasil-em-2020.html
• LINKEDIN. Ajuda- Entre em contato com o Suporte do LinkedIn - Ask questions about our Privacy Policy. Available at: https://www.linkedin.com/help/linkedin/ask/ppq. Accessed on: 25 mai. 2021a.
  » https://www.linkedin.com/help/linkedin/ask/ppq.
• LINKEDIN. Ajuda- Entre em contato com o Suporte do LinkedIn - Contacting LinkedIn's Data Protection Officer. Available at: https://www.linkedin.com/help/linkedin/ask/TSO-DPO. Accessed on: 25 mai. 2021b.
  » https://www.linkedin.com/help/linkedin/ask/TSO-DPO.
• LINKEDIN. Ajuda- Idade ou Gênero Inferidos No LinkedIn. Available at: https://www.linkedin.com/help/linkedin/answer/8034/idade-ou-genero-inferidos-no-linkedin?lang=pt. Accessed on: June 25, 2021c.
  » https://www.linkedin.com/help/linkedin/answer/8034/idade-ou-genero-inferidos-no-linkedin?lang=pt.
• LINKEDIN. Dados Demográficos. Available at: https://www.linkedin.com/psettings/advertising/demographics. Accessed on: May 25, 2021d.
  » https://www.linkedin.com/psettings/advertising/demographics.
• LINKEDIN. Informações demográficas pessoais. Available at: https://www.linkedin.com/psettings/demographics. Accessed on: May 25, 2021e.
  » https://www.linkedin.com/psettings/demographics.
• LINKEDIN. Gender Insights Report. Available at:https://business.linkedin.com/talent-solutions/diversity-inclusion-belonging/gender-balance-report. Accessed on: May 25, 2019.
  » https://business.linkedin.com/talent-solutions/diversity-inclusion-belonging/gender-balance-report.
• LINKEDIN. Política de Privacidade. Available at:https://br.linkedin.com/legal/privacy-policy. Accessed on: May 25, 2021f.
  » https://br.linkedin.com/legal/privacy-policy.
• LINKEDIN. Políticas para Comunidades Profissionais do LinkedIn. Available at: https://br.linkedin.com/legal/professional-community-policies?. Accessed on: May 25, 2021g.
  » https://br.linkedin.com/legal/professional-community-policies?.
• MARÇAL, Gabriela. Tinder é acusado de transfobia por artista e mais usuários relatam exclusão de perfis. O Estado de S. Paulo, São Paulo, 12 jul. 2020. Available at:https://emais.estadao.com.br/noticias/comportamento,tinder-e-acusado-de-transfobia-por-artista-e-mais-usuarios-relatam-exclusao-de-perfis,70003361682 Accessed on June 15, 2021.
  » https://emais.estadao.com.br/noticias/comportamento,tinder-e-acusado-de-transfobia-por-artista-e-mais-usuarios-relatam-exclusao-de-perfis,70003361682
• MISKOLCI, Richard. A Teoria Queer e a Sociologia: o desafio de uma analítica da normalização. Sociologias, Porto Alegre, v. 11, n. 21, 2009, p. 150-182.
• MOMBAÇA, Jota. Rumo a uma redistribuição desobediente de gênero e anticolonial da violência! Oficina Imaginação Política, 2016, p. 1-20. Avaible at: https://issuu.com/amilcarpacker/docs/rumo_a_uma_redistribuic__a__o_da_vi Accessed on December 21, 2021.
  » https://issuu.com/amilcarpacker/docs/rumo_a_uma_redistribuic__a__o_da_vi
• MULHOLLAND, Caitlin. O tratamento de dados pessoais sensíveis. In: MULHOLLAND, Caitlin (org). A LGPD e o novo marco normativo no Brasil. Porto Alegre: Arquipélago, 2020. p. 121- 155.
• ORAZEM, Eloá. Existe amor na pandemia: Tinder vê aumento de usuários, de atividades (e do lucro). NeoFeed, 01 dez. 2020. Available at: https://neofeed.com.br/blog/home/existe-amor-na-pandemia-tinder-ve-aumento-de-usuarios-de-atividades-e-do-lucro/. Accessed on: June 10, 2021.
  » https://neofeed.com.br/blog/home/existe-amor-na-pandemia-tinder-ve-aumento-de-usuarios-de-atividades-e-do-lucro/.
• PRECIADO, Paul B. Testo yonqui. Madrid: Espasa Calpe, 2008.
• QUELLE, Claudia. The ‘risk revolution’ in EU data protection law: We can’t have our cake and eat it, too. Tilburg Law School Legal Studies Research Paper Series, nº 17, 2017. Available at: http://ssrn.com/abstract=3000382. Accessed on: June 15, 2021.
  » http://ssrn.com/abstract=3000382.
• QUINN, Paul; MALGIERI, Gianclaudio. The Difficulty of Defining Sensitive Data - The Concept of Sensitive Data in the EU Data Protection Framework. German Law Journal, (Forthcoming), 2020. Available at: http://dx.doi.org/10.2139/ssrn.3713134
  » http://dx.doi.org/10.2139/ssrn.3713134
• RAMOS, Marcelo Maciel. Teorias Feministas e Teorias Queer do Direito: Gênero e Sexualidade como Categorias Úteis para a Crítica Jurídica. Rev. Direito e Práx., Rio de Janeiro, v. 12, n. 3, 2021, p. 1679-1710.
• RIOS, Roger Raupp. Tramas e interconexões no Supremo Tribunal Federal: Antidiscriminação, gênero e sexualidade. Rev. Direito e Práx. Rio de Janeiro, v. 11. n. 2, 2020, p. 1332-1357.
• RESENDE, Thiago. Governo brasileiro multa Facebook em R$ 6,6 mi por compartilhamento de dados. Folha de S.Paulo, December 30, 2019. Available at: https://www1.folha.uol.com.br/mercado/2019/12/governo-brasileiro-multa-facebook-em-r-66-mi-por-compartilhamento-de-dados.shtml. Accessed on: July 19, 2021.
  » https://www1.folha.uol.com.br/mercado/2019/12/governo-brasileiro-multa-facebook-em-r-66-mi-por-compartilhamento-de-dados.shtml.
• RODOTÀ, Stefano. A vida na sociedade da vigilância: a privacidade hoje. Rio de Janeiro: Renovar, 2008.
• SANTO CAOS. Demitindo Preconceitos: porque as empresas precisam sair do armário. Santo Caos, 2015. Available at: https://estudos.santocaos.com.br/demitindopreconceitos/. Accessed on: June 5, 2021
  » https://estudos.santocaos.com.br/demitindopreconceitos/.
• SILVA, Beto. A Era LinkedIn. IstoÉ Dinheiro. Ed. 1229 02.07, May 22, 2020a. Available at: https://www.istoedinheiro.com.br/a-era-linkedin/. Accessed on: June 5, 2021
  » https://www.istoedinheiro.com.br/a-era-linkedin
• SILVA, Douglas Vieira da. Brasil é o 4º país com mais usuários no Facebook na quarentena TechMundo, 27 de maio de 2020b. Available at: https://www.tecmundo.com.br/redes-sociais/153570-brasil-4-pais-usuarios-facebook-quarentena.htm. Accessed on: June 15, 2021.
  » https://www.tecmundo.com.br/redes-sociais/153570-brasil-4-pais-usuarios-facebook-quarentena.htm.
• SILVA, Mariah Rafaela; VARON, Joana. Reconhecimento facial no setor público e identidades trans: tecnopolíticas de controle e ameaça à diversidade de gênero em suas interseccionalidades de raça, classe e território. Codin Rights: Rio de Janeiro, 2021. Available at:https://codingrights.org/docs/rec-facial-id-trans.pdf. Accessed on: June 29, 2021.
  » https://codingrights.org/docs/rec-facial-id-trans.pdf.
• SKINNER-THOMPSON, Scott. Privacy at margins. Cambridge: Cambridge University Press, 2021.
• TINDER. Centro de Segurança e Política do Tinder. Available at: https://policies.tinder.com/safety-and-policy/intl/pt Accessed on: 25 mai. 2021a.
  » https://policies.tinder.com/safety-and-policy/intl/pt
• TINDER. Diretrizes da Comunidade. Available at: https://www.gotinder.com/community-guidelines Accessed on: May 25, 2021b.
  » https://www.gotinder.com/community-guidelines
• TINDER. Política de Privacidade. Available at:https://policies.tinder.com/privacy/intl/pt#information-we-collect Accessed on: June 25, 2021c.
  » https://policies.tinder.com/privacy/intl/pt#information-we-collect
• TINDER. Termos de Uso. Available at:https://policies.tinder.com/terms/intl/pt. Accessed on: May 25, 2021d.
  » https://policies.tinder.com/terms/intl/pt.
• VOLPATO, Bruno. Ranking: as redes sociais mais usadas em 2021 no Brasil e no mundo, insights e materiais gratuitos. Resultados Digitais, 11 jan. 2021. Available at:https://resultadosdigitais.com.br/blog/redes-sociais-mais-usadas-no-brasil/#. Accessed on: June 10, 2021
  » https://resultadosdigitais.com.br/blog/redes-sociais-mais-usadas-no-brasil/#.
• VOTELGBT; BOX1824. Diagnóstico LGBT+ na Pandemia 2021. #VoteLGBT, Jun. 2021. Available at:https://static1.squarespace.com/static/5b310b91af2096e89a5bc1f5/t/60db6a3e00bb0444cdf6e8b4/1624992334484/%5Bvote%2Blgbt%2B%2B%2Bbox1824%5D%2Bdiagno%CC%81stico%2BLGBT%2B2021+b+%281%29.pdf /. Accessed on: June 5, 2021.
  » https://static1.squarespace.com/static/5b310b91af2096e89a5bc1f5/t/60db6a3e00bb0444cdf6e8b4/1624992334484/%5Bvote%2Blgbt%2B%2B%2Bbox1824%5D%2Bdiagno%CC%81stico%2BLGBT%2B2021+b+%281%29.pdf /.
• ZANATTA, Rafael. Proteção de dados pessoais como regulação de risco: uma nova moldura teórica? In: I Encontro da Rede de Pesquisa em Governança da Internet, 2017, Rio de Janeiro. Artigos Selecionados REDE 2017. Available at:http://www.redegovernanca.net.br/public/conferences/1/anais/ZANATTA,%20Rafael_2017.pdf. Accessed on: June 21,2021.
  » http://www.redegovernanca.net.br/public/conferences/1/anais/ZANATTA,%20Rafael_2017.pdf.
• ZUBOFF, Shoshana. A Era do Capitalismo de Vigilância: a luta por um futuro humano na nova fronteira do poder. Rio de Janeiro: Intrínseca, 2020.

• 1
  This research was developed within the scope of the Compliance and Data Protection project of the Center for Education and Research on Innovation (CEPI) at FGV São Paulo Law School.
• 2
  The acronym LGBTQIA+ encompasses lesbian, gay, bisexual, transsexual, transvestite, queer, intersex, and other sexual identities and orientations that are not included in the heterosexual and cisgender pattern.
• 3
  Trans people are those who identify with a different gender from the one assigned to them when they were born. Non-binary people, on the other hand, are those who do not identify themselves by binary gender identities, that is, they fit neither as man/male nor as woman/female. There are also people of fluid gender, who move between male and female, and ageneres, who have a neutral gender identity.
• 4
  Heterocisnormativity can be understood as a social and historical construction of compulsory imposition of heterosexuality and cisgenderity, which marginalizes sexual and gender identities that do not correspond to the normative standards of gender and sexuality.
• 5
  The survey did not find up-to-date data on the specific number of Tinder users in Brazil, but, as already pointed out, the country ranks third in the ranking of countries with the most users, according to Grupo Match, the corporation to which Tinder belongs, which does not disclose specific numbers on the number of users.
• 6
  Video available at: https://www.youtube.com/watch?v=XP90QAnmaA4 . Accessed on: June 10, 2021.

Publication Dates

• Publication in this collection
  27 Mar 2023
• Date of issue
  Jan-Mar 2023

History

• Received
  30 Aug 2021
• Accepted
  23 Jan 2022