Gender Identity, Personal Data and Social Networks: An analysis of the categorization of sensitive data from a queer critique

Abstract This article addresses the possibility of classifying gender identity as sensitive data, taking into consideration the parameters of Law 13.709/2018 and the queer theory. It presents a literature review and a documental analysis of terms from social networks. As a result, gender identity must be understood as sensitive data due to the vulnerability of non-cisgender people.


Introduction 1
The Brazilian General Data Protection Law-Lei Geral de Proteção de Dados-(LGPD -Law 13.709/2018), in force since September 2020, determines the duties and obligations of agents that carry out operations for the processing of personal data.The law also consolidates a series of rights and guarantees of the natural persons to which the data refer -the so-called data subjects.
In the categorization of that data, the LGPD introduces a list of sensitive personal data (art.5, item II) that has a distinct regime of obligations.In this list, the law mentions, objectively and explicitly, data on sexual life, not specifically addressing data related to gender identity, that is, the way in which the person expresses the gender with which he/she identifies.As this data is not simply related to biological factors, but mainly to personal, social, and cultural issues, the questions that guide this research arise: 1) How is data on gender identity processed and protected?2) What are the possibilities and justifications for categorizing gender identity as sensitive data?
In this regard, classifying gender data as sensitive may be a necessary protective measure when we think about the Brazilian context, where systemic violence directed at the LGBTQIA+2 population occurs, especially to people outside the cisgender conformation, susceptible to suffering more physical violence only because of their identity.According to surveys carried out by the National Association of Transvestites and Transsexuals (ANTRA), in 2020, 175 transvestites and transsexual women were murdered, a number that represented an increase of 41% compared to the previous year.Among the victims, 78% were black and 72% were sex workers (BENEVIDES;NOGUEIRA, 2021).
The inadequate processing of information about the gender of trans or nonbinary 3 people can seriously violate their personalities, creating contexts of discrimination for an already extremely marginalized population.Certain cases reveal how technologies and data processing can fuel violence based on the gender identity of vulnerable populations.Researchers Mariah Rafaela Silva and Joana Varon developed a study on the use of facial recognition in the Brazilian public sector and trans identities, in which they warn about the risks and discriminatory practices embedded in technology and data processing, which specifically affect the trans population.This scenario is aggravated by the lack of transparency, which makes it difficult to measure the harmful effects when assessing socioeconomic, racial, and territorial issues of trans people (SILVA; VARON, 2021).
Thus, given the normative silence, it is up to public and private agents, in the position of personal data controllers, to determine which interpretation to give to gender data.In this regard, interpretive alternatives are appropriate: (i) consider gender data as sensitive personal data, understanding that it is included in data about sexual life; (ii) consider it as sensitive personal data, understanding the list of art. 5 as an example and this information as autonomous and not related to sex life, starting from a contextual assessment, in accordance with art.11, § 1st; and (iii) not considering it as sensitive personal data, considering the list of article 5 as exhaustive, and that the data is not covered by information about sexual life.Thus, the article explores which of the interpretations data controllers have been adopting in the country.Furthermore, the first and second interpretative possibilities are evaluated from the perspective of queer theory contributions.
In this context, this article seeks to analyze (i) how sensitive data is classified in the LGPD; (ii) how it would be possible to interpret data on gender identity as sensitive; and (iii) how personal data related to gender identity is handled by large companies.
Therefore, the work presents an empirical investigation into the social networks Facebook, LinkedIn, and Tinder.Subsequently, interpretive ways are proposed to categorize gender identity as sensitive data, through the normative mechanisms offered by the LGPD, analyzed from a queer perspective.

Theoretical demarcation and methodological options
This research arose from the questioning about the limits and the strictness, or not, of the category of sensitive data brought by the LGPD, which does not consider data on gender or gender identity as sensitive.Therefore, this article gives special focus to non-cisgender people.Cisgenderity is based on a binary and biological pattern of man/male and woman/female This text focuses on other gender identities that do not correspond to this pattern, such as transsexuals, transvestites, agenres, non-binary, and fluid gender.
The research starts from a critique from the perspective of queer theory to the way in which the LGPD, as well as the socio-juridical structures that make up its field of implementation and applicability, are crossed and composed by heterocisnormativity4 .This criticism explains, in part, the express absence of gender identity as sensitive data in the Brazilian law for the protection of personal data.The criticism, however, does not end with verifying the legislative omission, but continues with the need to interpret the normative dynamically, so that it allows tensioning the structural elements of universality and neutrality of the law, which discriminate against people non-compliant with normativity.Thus, the objective of this work is not to reduce queer criticism to a theorization, but rather to propose a perspective of analysis and confrontation of heterocisnormative structures in legal norms that directly affect the protection of identities that deviate from normativity in contexts of personal data processing.
In this regard, queer theory can be conceived as a critical path capable of examining how "laws, court decisions, theories of law, in their categories and presuppositions" are elements produced and reproduced from the systematic logic of sexist and heteronormative devices that comprise a binary view of gender, which perpetuates violence against and the marginalization of people who do not meet the gender standards restricted to the biological idea of cisgenderness (RAMOS, 2020, p. 3) (our translation).
Teresa de Laurentis was the first to use the term queer academically at a conference in 1990, in which she denounced the heterosexist character of studies on sexual diversity at the time (DE LAURENTIS, 1991).The choice of the term queer, which can be translated as "weird" and which was understood as "a curse that denoted abnormality", serves to highlight a critique of the construction of normality, especially in terms of sexual and gender identity (MISKOLCI, 2009, p. 151) (our translation).However, the term was also redefined by social movements of LGBTQIA+ people, where the letter "Q" designates queer people, that is, those who do not meet gender norms.B. Preciado (2008) articulates the queer theory indicating that the norms of gender and sexuality have overcome a sense of separation between power and subjectivation.For the author, gender is an effect of discursive and visual practices that emanate from different institutional devices, such as the family, religion, school, the media, the biomedical, legal, and even cinema.The body, however, is not limited to a prediscursive result, nor a purely biological fact, as it is also constituted in the relationship with the production of materials and technoscientific flows.

Paul
In this sense, a queer critique must involve issues that go beyond the constructions of identities that are categorized and marginalized and highlight the dehumanization effects of dissident bodies.Thus, discussing the protection of sensitive personal data must include a perspective on how data subjects cannot be neutralized as if their information locates them in the same social spaces and possibilities.
The articulation of queer criticism in law follows a process of contestation of universalist legal categories.Thus, the choice for the queer theoretical demarcation is an option for an analysis lens for the critique of law, especially to what concerns data protection legislation and its implementation, using data on gender identity as an analysis variable.
Thus, the search for empirical data appeared as a research demand, to understand whether the self-regulation of companies in the paths of data processing complies with the applicable legislation and if it would enable, by itself, the protection of gender identity as sensitive data.
Social networks were chosen because they are popular and because they make it possible to observe the interpretation of gender data in experiences with a great impact on the debate on data protection.Networks with different approaches were selected, namely: (i) Facebook as a social network for affinity and sociability purposes, with 130 million Brazilian users; (ii) LinkedIIn as a social network for work and professional contact, with 46 million users in Brazil; and (iii) Tinder as a network for relationships and encounters, with Brazil being the third country in the number of users (VOLPATO, 2021;ORAZEM, 2020;ALBACH, 2017).
The technique used to collect and evaluate research data was document analysis.The following documents were considered: (i) Facebook: Terms of Use, Data The analytical steps developed by researcher André Cellard (2008) were followed, who highlights the importance of a critical preliminary assessment of documents.Thus, we started from the assumption of documental complexity, considering its limitations as an important part of the analytical process.The elements extrinsic to the documents were observed, such as the social context in which they are produced, the authenticity and reliability of the texts taken from official platforms (CELLARD, 2008, p. 300-301).Then, categories based on core elements of the LGPD were created, structured in a question format, to facilitate the search and collection of data.
Box 1: Categories/questions of document analysis.Source: Prepared by the authors.
The categories created were gathered in order to understand how privacy policies expose the functioning of data processing -especially personal data of gender.
For this reason, the categories were developed based on key elements for an assessment of a company's suitability for the LGPD.The main objective of the study was to empirically verify whether this information is considered sensitive in the process of social networks.
There are, however, limitations in document analysis, such as the insufficiency of some information in the documents, or the lack of transparency in certain points.
The research assumes that the categories listed can extract a partial analysis of the documental content, as other questions could be prepared.In addition, there is the limitation of the field cut, restricted to the chosen networks, and the timeframe, as the analysis was carried out between May and June 2021, making it possible for companies to modify these documents over time.The investigation, therefore, does not aim to exhaust the analytical possibilities and understands the limitations of research directed towards an article.Thus, it is demarcated that the study can be expanded or replicated to other fields aligned with this research.

How gender identity data is handled by Social Networks in Brazil
With the entry into force of the LGPD, several companies, including social networks, began to adapt their internal policies to the legislation, to guarantee their users' rights and avoid future sanctions by the National Data Protection Authority (ANPD).The method adopted by these companies to carry out the adjustment reflects how the LGPD is being applied and how personal data is being protected.It also reflects the level of discussion about contexts not explored by the law, such as the data on gender identity.The following topics bring the results observed in the documents relating to the privacy policy and data processing of Facebook, LinkedIn, and Tinder.

2.a Facebook
Facebook is now one of the five largest companies in the US Silicon Valley.
Researcher Shoshana Zuboff (2020) points out that the network is related to the dissemination of the business model based on the processing of personal data to deepen the ability to influence the choices of its users with targeted advertisements and publicity.
Currently, the company dominates a large portion of the digital market (e.g.WhatsApp and Instagram), a fact that has been stimulating several discussions in the field of data protection (MCLAUGHLIN; KERN, 2021).
According to Facebook (2021a), its mission is to empower people to build communities and bring the world together, with security and privacy protection being one of its principles.Recently, the company reached the mark of 3 billion active users around the (FACEBOOK, 2021a), with Brazil being the 4th country with the most users on the platform, with approximately 120 million active accounts (SILVA, 2020a), which is equivalent to more than half of the Brazilian population.To register on Facebook, the information required is: first name, last name, email, date of birth, and gender.

Legal bases
To Source: Prepared by the authors.
In the policy, "data with special protections" is mentioned for "providing, customizing and improving our products", which includes providing personalized experiences to users and improving Facebook's products, purposes about which there is little information.It also comprises "selecting and customizing advertisements, offers and other sponsored content (...)", relating to Facebook's business model.According to the company, advertisers carry a list of information about the target audience they want to reach, and Facebook matches the ads to users' timelines.
For this purpose, the company makes available tools (FACEBOOK, 2021c) to control personal data, allowing users, for example, to choose whether some data can be used to target ads.However, there is no way to configure the use of personal data on gender to target ads.Also on this link, Facebook draws attention to the fact that, despite the settings made available, advertisers will still be able to reach the user "by choosing categories related to age, gender, location (...)".Therefore, it is concluded that Facebook uses personal data of gender to target ads, with no choice for the user.Source: Prepared by the authors.
Despite provisions stating that Facebook only shares identified data with the consent of users, the company accumulates scandals involving improper sharing of personal data.The best-known case is that of political marketing consultancy Cambridge Analytica, sanctioned by the National Consumer Protection Secretariat (Senacon) (RESENDE, 2019).But there are also cases under investigation by the same Secretariat, of sensitive data illegally received (such as heart rate and menstrual cycle) by a partner application and data sharing with the WhatsApp instant messaging network (BUCCO, 2021) In common, in addition to dealing with improper sharing, all cases involve the use of sensitive data to target ads.

2.b LinkedIn
LinkedIn defines itself as a platform for professionals, whose purpose is to promote connections, acquire work opportunities, establish and strengthen professional relationships, and even for business purposes.According to data released in 2020, the site had 46 million users in Brazil (ÉPOCA NEGÓCIOS, 2020) and 738 million users around the world (GREENHALGH, 2021), with an average of 100,000 new profiles created daily ( SILVA, 2020b).
LinkedIn requires little information to create a profile, such as: name, email address and/or mobile device number, and password.Still, the platform infers gender data about its users as stated in LinkedIn's privacy policy (LINKEDIN, 2021f).According to the platform, the inference is based on the name or pronouns used when users recommend each other's competences (LINKEDIN, 2021c).Therefore, it is important to understand how gender data is processed.

Legal bases
The Source: Prepared by the authors.
It is noteworthy that, as to the purpose, the way in which information about gender is reflected in targeted advertisements is not mentioned.In the account settings area, it is only informed that the user will continue to see the same number of ads, but these will be "less relevant" (LINKEDIN, 2021d).It is possible to stop targeting ads based on gender inference if the user chooses to do so -which does not prevent gender inference itself.
Regarding the "voluntary demographic information of self-identification", it is possible to identify, in the individual's profile configurations, with the "female", "male", "other gender identity" or "prefer not to declare" gender.This data is not displayed and, depending on the platform, is used for statistics, news, announcements, and personalized content (LINKEDIN, 2021e).Although there is the user's consent to fill in these "demographic" fields, the platform's inference about the user's gender happens regardless of his/her will.
The platform has a binary perception of gender issues.This is inferred from the analysis of reports generated annually, such as the "Gender Insights Report" (LINKEDIN, 2019), which demonstrates how women and men get involved in jobs in different ways.
The possibility of the user identifying himself with non-binary gender identity was only considered by LinkedIn in March 2021, when the network allowed the inclusion of pronouns in the profiles created -including neutral pronouns.That modality was only incorporated in five countries: the United States, Great Britain, Sweden, Canada, and Ireland (GREENHALGH, 2021).
The lack of perception about a population that is outside the normative cisgender scope by the platform is worrying, considering that, in Brazil, 38% of companies have restrictions to hire LGBTQIA+ (SANTO CAOS, 2015), 90% of trans and transvestite women have prostitution as the source of income and subsistence (BENEVIDES; NOGUEIRA, 2021, p. 44) and that, during the COVID-19 pandemic, the unemployment rate of the trans population was 20.47%, higher within the LGBTQIA+ community itself, whose average unemployment was 17.5% (VOTELGBT; BOX1824, 2021).Other aspects were evaluated to characterize the level of protection and guarantees in the network, as shown in the table below.Source: Prepared by the authors.
While users can contact LinkedIn's Data Protection Officer (LINKEDIN, 2021b) directly to request clarification about themselves, as well as Support for clarification on the privacy policy (LINKEDIN, 2021a), the pages presented are in English, which may imply a barrier for data subjects to exercise their rights.

2.c Tinder
Tinder is a relationship network created in 2012 in the United States.The platform works from the geolocation of users and aims to create links and contacts between profiles, being especially used through an application (app).The network has millions of users worldwide.In Brazil alone, it already had ten million users in 2014, equivalent to 10% of the total users in the world5 (JUNQUEIRA; VENTURA, 2019).Tinder users are looking for matches (combinations), made between profiles when there is a mutual approval between them through what is called a 'like'.
When creating a Tinder profile, the login options are a Google email, Facebook profile, or phone number.Data such as the gender and age of the user is required.The network offers the gender options man, woman, and "more", in which other identities can be freely included.The user chooses whether to display the gender in the profile.
Tinder provides a text explanation of the "more" option as a way to include diverse gender identities.The matter is also clarified through the speech of people who represent these identities in a video on the platform's page 6 .This is an inclusion tool, as it provides explanations in text and video, in accessible language, and with representative communicators.However, the video was produced in English, which limits the information for Brazilian users.
The network, however, receives complaints from trans people who have their profiles banned without justification or for a generic violation of community guidelines.
In this regard, the company responded that it does not ban users due to their gender identity; it is a complex context in which users report the accounts of trans people.The network recognized that trans people face challenges and said it is working to improve their practices, with the support of specialized organizations (MARÇAL, 2020).In addition, Tinder provides a contact email where people can complain if they believe their profiles have been unfairly banned.
In this context, at first, it is important to demarcate how Tinder handles sensitive data, for what purpose and how it collects gender data and whether it has content on the principle of non-discrimination in its terms.Source: Prepared by the authors.
Gender information can also be inferred from user interactions and content, or by connecting to other networks (e.g.Facebook and Instagram).When explaining the use of automatic decision-making performed by the network algorithm, Tinder indicates that it uses gender and other data to feed the matches algorithm, but does not use information such as race, ethnicity, income, and religion.It is noteworthy that the network also handles data from conversations between users, as well as the content that users publish, as part of the operation of services (TINDER, 2021) However, the failure to obtain specific and detailed consent on gender data indicates that the company still does not perceive this data as sensitive, which characterizes an opening for violations.Other aspects were evaluated to characterize the level of protection and guarantees in the network, as shown in the table below.Source: Prepared by the authors.
Although Tinder indicated security precautions, in 2020, Senacon notified the platform for selling users' data to other companies to improve the efficiency of advertisements (LARA, 2020).In this regard, the network's privacy policy indicates that it can share personal data, including gender, to develop and provide advertising (TINDER, 2021c).
Among the rights of data subjects, uninstalling interrupts data processing, but the network continues to store the mobile identifier associated with the device.Data subjects can also call the ANPD (National Data Protection Authority) for complaints.
Furthermore, the three-month timeframe for deleting the data may not be met due to technical limitations (TINDER, 2021c).

Gender identity as sensitive data: interpretations for anti-discrimination protection
LGPD, in its art.5, item II, indicates that sensitive personal data is personal data on racial or ethnic origin, religious belief, public opinion, affiliation to union or religious, philosophical or political organization, data relating to the health or "sex life", genetic or biometric data.Since the law is risk regulation, the creation of this category implies that agents who process sensitive personal data consider their operations as riskier in relation to the fundamental rights and freedoms of data subjects, thus requiring greater security and protection of the flows of said data (QUELLE, 2017;ZANATTA, 2017;BIONI;LUCIANO, 2019).
It is noteworthy that the creation of the sensitive data category is part of a pragmatic observation process about the different effects caused by the processing of said data in relation to others.Thus, the very selection of which data would be sensitive demonstrates that the circulation of certain information can lead to greater harm to its data subjects, in a given social configuration (DONEDA, 2019, p. 143).The simple formation of profiles based on sensitive personal data can lead to discrimination due to several factors.Among them, it is possible to mention the fact that personal data, apparently not "sensitive", can become sensitive if it contributes to the development of a profile, or even in contexts where the individual sphere itself can be violated when the person belongs to a stigmatized group or is associated with negative characteristics and interpretations (RODOTÀ, 2008), which is the case of non-cisgender populations.However, it is not clear in the LGPD whether the data considered sensitive consists of an exhaustive or exemplary list.Likewise, there is no official guidance from ANPD (National Data Protection Authority) and legislation regarding the possibility or the obligation to understand gender identity as data relating to sexual life.Thus, this research raised data and discussions to reflect on the categorization of data on gender identity as sensitive data.Given the absence of specific regulation, the main objective is to explore how large social networking companies, which occupy different aspects of everyday life: social, romantic, family and work relationships, are self-regulated.As the analysis of the networks revealed, companies do not show in their respective policies the way they interpret and, therefore, process personal gender data.The global analysis of the documents allows us to infer that such data is not classified by them as sensitive information, which indicates the need for clarification by the regulatory authority on this matter.This classification would place companies that process gender identity data with more significant obligations to protect such data.Furthermore, it would make processing based on the legal hypothesis of legitimate interest impossible, in addition to limiting the use of the legal basis of consent, which, for sensitive data, must be provided in a specific on race, which does not go through a division based on distinctions of privilege or social oppression.Furthermore, the interpretation of gender identity as information on sexual life provides immediate application of the sensitive data regime, restricting the possibilities to process this type of data.
The idea of gender aligned with aspects of sexual life is diffused in queer theory, which subverts and challenges the normativity of bodies.Judith Butler (1990) stresses the binary construction of gender, demarcating that it is focused on sexual relations, the body not being naturally sexual, but marked by a gender identity produced from culturally produced performativity.Thus, gender identity does not determine our behaviors, but we conceive identity by the behavioral patterns we reproduce (BUTLER, 2020, p. 242-243).
This perspective strengthens the perception that gender is an expressive path in the construction of the sexual sphere, including non-normative identities that subvert binary logics.
In terms of Brazil, thinking about gender and sexuality requires a careful look at a society that includes a perspective on the distribution of violence.Jota Mombaça (2016) explains that vulnerable populations such as people who do not obey cisnormativity receive a greater share of violence in the Brazilian social structure.That is to say, to be a non-cisgender person is to become a less human target in a racist, sexist, classist, and lgbtphobic society.It is important to highlight that not recognizing one's gender, or misgendering a person, even if in the context of a social network, reinforces the idea that the space that this person occupies, the society that they find themselves into, do not consider their person's gender real.This implies rejection, impacts their self-esteem and confidence, lack of authenticity and increases one's perception of being socially stigmatized (KEYES, 2018).Skinner-Thompson (2021) reveals dimensions of what he calls "privacy on the margins," referring to the historical and sociocultural constructs that underpin the relationship between surveillance and privacy for vulnerable populations.The researcher debates the possibilities of security in the private life and freedom of LGBTQIA+ people, emphasizing that historically non-heteronormative people face surveillance contexts and social restrictions.In this sense, the improper treatment of information about this population tends to increase the discriminatory context.In other words, surveillance of LGBTQIA+ people is a historical and structural process of discrimination and categorization of people based on their identities and sexual practices.This process affects the ways in which these people are treated, therefore, information about their lives can be used in a negative way, reflecting perceptions that already marginalize them in society.
At this juncture, thinking about the protection of data on gender identity reveals the need to assess the social factors surrounding this information, as well as the discriminatory and harmful potential of its processing, whether in a private sense, since it is evident that the identity of gender is a very personal aspect, whether in terms of collective effects, as non-cisgender people already suffer systematic and structural violence for not meeting a normative gender expectation.
Thus, gender identity is information with significant discriminatory potential, and it can be used to exclude people who already suffer violence and limitations in the most diverse social sectors, such as education, health, and the labor market.In this scenario, the inadequate processing of gender data in social networks, for example, can translate into a significant collective impact, considering the context of sharing with other companies and the enormous capacity of popular social networks to collect this information from vulnerable groups.This understanding is justified because the category of sensitive data comprises personal data "especially susceptible to use for discriminatory purposes, such as stigmatization, exclusion or segregation", which may cause violations of people's dignity, personal identity, and privacy (KONDER, 2019, p. 455) (our translation).Therefore, it is possible to understand that there is no exhaustive list of sensitive data in the LGPD, as such data is classified according to the level of harm it presents in each processing.
Paul Quinn and Gianclaudio Malgieri (2020, p. 29-30) analyze the European context of the discussion on sensitive data protection and argue about the need to rethink the approach that is used for this category of data.The authors thus propose a hybrid approach, taking into account the purpose of the processing of sensitive data.For them, personal data should be considered sensitive if the controllers' intention is to process or discover sensitive information or if it is reasonably foreseeable that such data could be used to reveal or infer sensitive aspects.This formulation is defended by the authors as a form of balance for analyzing the context of sensitive data processing, avoiding disproportionate interpretations.In this way, the concept of sensitive data remains viable, and a real level of protection is provided to data subjects who may be in a vulnerable position and at risk of discrimination and mitigation of other fundamental rights.The very act of inferring gender data, it is important to emphasize, implies a paradox of privacy.This is because analyzing this data without considering the user's will implies accessing information that people might not want to share.In order to deal with this information, or seek to correct it (in the case of misgendering), users find themselves obliged to provide even more additional information, disclosing more data or more detailed information about themselves (CUSTERS 2013).Thus, gender identity is information that, when processed illegally and abusively, can generate private and collective damage.Therefore, interpreting this data as sensitive also includes a perspective that any sensitive data, when processed outside the legal hypotheses of art.
11, I, II, of LGPD, "will always generate damages of a very personal nature for violation of the rights of privacy, freedom or identity, fundamentals of data protection".Thus, the damage would be in re ipsa, without the need for proof of other legal consequences, which does not remove the possibility of a person claiming the existence of concrete damage to their personality (MULHOLLAND, 2020, p. 131-132) (our translation).
The proposals for interpreting gender identity as sensitive data presented in this work especially consider the non-cisgender population, considering that sexual and gender diversity brings together a context of various types of violence.However, the interpretations aim, in the first place, to ensure that the legislation fulfills its objective of a broad protection of the natural person against violations of their personal data, with the category of sensitive data having greater protective robustness, in line with the principle of non-discrimination established by law.Thus, having identified the great harmful potential of the processing of gender identity data, what remains for the processes of adjustment to the LGPD is to follow the provisions on the sensitive data regime, added to the legal basis, which advocates the development of personality and human dignity in its art.2, VII.
In this regard, in LGPD implementation processes, data on gender identity must be understood as sensitive, either by its insertion in the term "sexual life" provided for in the list of sensitive data in the LGPD, or by a contextual assessment that gives it the elements for configuration as sensitive data, namely: (i) very personal information; (ii) discriminatory potential; and (iii) harmful potential.Both interpretations follow the perception that the discriminatory effects are not in the data itself, but in its use (DONEDA, 2019, p. 144).However, certain types of information configure a greater context of vulnerability for its data subjects.
Thus, the proposed interpretations establish possibilities to expand the LGPD's tutelage and include a panorama for data subjects who face social contexts of greater vulnerability.In this scenario, injustices and demands related to gender and sexual life put the right to anti-discrimination to the test, while challenging and developing it.That reveals the need for a "juridical-scientific methodological stance, marked by theoretical concern with the understanding of existing legal categories and their relationship with gender and sexuality" (RIOS, 2020, p. 1335) (our translation).Therefore, the exercise of interpreting the LGPD beyond the norm and normativity was based on the queer perspective, as a way of stressing the category of sensitive data, including human and identity factors still little seen by lawmakers and, as also observed in empirical research, by companies in their privacy and data protection policies.

Conclusion
As shown, the purpose of the LGPD was to provide autonomy to data subjects regarding their personal information.One of the principles of this new law is non-discrimination in order to safeguard data subjects from exposure to vexatious situations or greater vulnerability, certain data is determined to be sensitive data -which should be processed with greater caution.
Among sensitive personal data, there is the term "sexual life", which, due to its vagueness, does not make explicit whether it also protects data on gender identity.This normative lack is related to a culture of marginalization of debates about gender diversity.
As a consequence, express norms are not produced to protect identities that do not behave in a binary gender perspective -which is divided by the male/female parallel and does not correspond to the identity diversity of the population.This scenario contributes to the consolidation of contexts of discrimination, vulnerability, and violence for noncisgender people.
However, it is possible to understand that data on gender can be considered sensitive data, both from an extensive interpretation of the term "sexual life", in article 5, II, LGPD, as from the very definition of the term sensitive data (as data that exposes data subject to greater vulnerability) in line with the interpretation of article 11 §1, LGPD, which leads to the interpretation that the list of sensitive personal data is not, per se, exhaustive.
Policy; Ads Preferences, Help Center -LGPD Inquiries and Contacting the Data Protection Officer (DPO); (ii) LinkedIn: LinkedIn Help: Inferred Age or Gender on LinkedIn, LinkedIn Help: How LinkedIn uses demographic data, Preferences: Advertising Data and Contact LinkedIn Support; (iii) Tinder: Tinder's Terms of Use, Community Guidelines, and Security Center and Policy.