This article addresses the possibility of classifying gender identity as sensitive data, taking into consideration the parameters of Law 13.709/2018 and the queer theory. It presents a literature review and a documental analysis of terms from social networks. As a result, gender identity must be understood as sensitive data due to the vulnerability of non-cisgender people.
Keywords:
Gender Identity; Data Protection; Queer Theory
| Category | Question |
|---|---|
| Sensitive data | What types of sensitive data does the network collect? |
| Transparency | Does the network have a privacy policy and terms of use written in understandable/less technical language? Does it describe well the data processing performed? |
| Non-discrimination | Does the network indicate any specific issues related to diversity and non-discrimination? |
| Rights of data subjects | Does the network indicate the rights of data subjects when using it and how to exercise them? How does it describe these guarantees? |
| Deletion | How does the network handle the data deletion issue? Does the network keep user data in the databases even after they delete the account? |
| Security | Does the network indicate security mechanisms for users' personal data? Which? |
| Gender data | Does the network collect data on gender? What are the options and collection methods? |
| Purpose | Does the network explicitly indicate the purposes for processing the gender data collected? |
| Legal bases | Does the network indicate the legal bases to process the gender data collected? |
| Sharing | Does the network indicate that it shares gender data with third parties? How does it justify sharing? Does it indicate the purpose of sharing and the third parties with whom it shares the data? |
| Sensitive data | Gender data | Non-discrimination | Purpose | Legal bases |
|---|---|---|---|---|
| To register, no sensitive data is collected. Said category of data is not included in the “data policy,” (FACEBOOK, 2021b). The company claims that profile data receive “special protections”. | Holders can only create a profile by providing data on gender which can be one of the options “female”, “male”, and “personalized”, selecting the appropriate treatment pronoun. | There are no non-discriminatory measures in the privacy policy. In the Community Standards (FACEBOOK, 2021h), the company states that hate speech cannot be published. | Data “with special protections” is used to “provide, customize and improve our products”, which includes “personalizing advertisements, offers, and other sponsored content”. | Gender identity data is collected through the legal basis of consent - but not in a specific and prominent way. |
| Security | Sharing | Deletion | Rights of data subjects | Transparency |
|---|---|---|---|---|
| The policy does not show security measures related to the flow of personal data. Manuals are provided for users to protect themselves on the network. | Personal data - including gender - is only shared with advertisers with the consent of the data subjects. If there is no consent, the data is shared anonymously. | Data storage occurs as long as it is useful to provide services and products or even account deletion, a determination that varies according to the case, with the purpose of the data, involvement of legal obligation, and nature of the information (FACEBOOK, 2021d and 2021e) | Provision of channels for inquiries about the LGPD (FACEBOOK, 2021f) - how to access, download and delete personal information, how to object to data processing - and contact the company's data protection officer (FACEBOOK, 2021g) | The terms are very descriptive, but some information is not detailed. The privacy policy makes no specific mention of gender identity. |
| Sensitive data | Gender data | Non-discrimination | Purpose | Legal bases |
|---|---|---|---|---|
| The platform can collect data on union membership if the holder wants to make it available on the network. | There is no field for gender declaration by the user in the Brazilian version. There is, however, the inference of gender through the platform. | There is a prohibition on content that spreads hatred and discriminatory actions against individuals or groups due to gender, among other aspects. | Gender data is inferred for ad targeting and can be entered to compose demographic information. | Gender identity data is collected through the legal basis of consent - but not specifically and prominently, based on legitimate interest. |
| Security | Sharing | Deletion | Rights of data subjects | Transparency |
|---|---|---|---|---|
| There is no processing that guarantees greater security, and the platform is not responsible for possible access and changes to the information sent. | There is no sharing of an individual member's inferred gender and age data with third parties. Data collected and shared is used as aggregated insights. | Deletes data after 30 days of account closure. However, data that does not identify the data subject is stored. | Delete, correct, revise and update information; delete the account; contact the Data Protection Officer. | The terms are very descriptive, but some information is not detailed. The privacy policy makes no specific mention of gender identity. |
| Sensitive data | Gender data | Non-discrimination | Purpose | Legal bases |
|---|---|---|---|---|
| Sensitive data such as ethnicity, race, sexual orientation, and religious beliefs are collected, as well as content such as photos and videos. | Data subjects can only create a profile by providing data on gender, which can be ‘man’, ‘woman’ or ‘other’, selected at their discretion | Community guidelines include the non-acceptance of hate speech of any kind, or violence and incitement to violence. | Gender data is basic login data, whose collection is intended for the operation of the service. | Gender identity data is collected through the legal basis of consent - but not in a specific and prominent way. |
| Security | Sharing | Deletion | Rights of data subjects | Transparency |
|---|---|---|---|---|
| Protects data from unauthorized access, alteration, disclosure, or destruction, including strict technical systems and encryption for users' photos and messages. | It shares data with service providers, service operation partners, other Match Group companies, and, in some cases, with legal authorities. | Retains data only as long as necessary for legitimate business interests. After deleting the account in the app, there is a period of three months to delete the data. | Delete, correct, revise and update information; whether or not to authorize access to the device; delete the account; uninstall; responsibility of the company. | The terms are very descriptive, but some information is not detailed. Besides, the privacy policy makes no specific mention of gender identity. |
