It has become increasingly common to discuss what "normal" bodies are and how "normal" gender and sexuality play a role in our society. When "normal" means cisgender and heterosexual, the LGBTQIA+ (lesbian, gay, bisexual, transgender, queer, intersex, asexual and other) community is easily forgotten about. This marginalization is a way to favor those who conform and, consequently, punish those who do not. LGBTQIA+ identities are often rejected through discrimination, inferiorization and criminalization.

In this scenario, lawmakers should support the LGBTQIA+ community. The law is a way to shape reality and protect the most vulnerable. This protection must be a way of "becoming equals when differences make us inferior" and "being different when equality takes away our characteristics." 

In a world progressively interconnected, the debate on gender identity and sexual orientation as sensitive personal data is an essential initial step that not all countries have taken. 

The recognition would help prevent processing this information for illicit or abusive purposes, as the Supreme Court of the United States' recent ruling on Title VII established when prohibiting employees' discriminatory discharge based on sexual orientation or gender identity. While we use Brazil's General Data Protection Law as background for this discussion, Brazil's issues are similar to other countries that do not explicitly recognize "gender identity" and "sexual orientation" as sensitive personal data. 

Sexual orientation as sensitive personal data

When identifying what information is sensitive, Article 5 Item II of the LGPD limits itself to data "related to sexual life" but does not actually define this term. 

A human rights–prone interpretation may argue "sexual life" comprises "sexual orientation," particularly considering the non-discrimination principle. In this sense, if "related to sexual life" in the LGPD does not encompass sexual orientation, what personal data does it refer to? However, a more literal and conservative interpretation could argue "sexual life" means only the core aspects of how individuals experience sex itself. 

International regulations and jurisprudence tend to support the former interpretation. For example, the EU General Data Protection Regulation recognizes both "data concerning a natural person's sex life" and "sexual orientation" as sensitive personal data. The GDPR uses these concepts in comparable situations in Recitals 71 and 75. 

Similarly, the Inter-American Court of Human Rights used the term "sexual life" when judging its first case on LGBT rights. It later replaced the term with "sexual orientation" in its more recent decisions, including Duke v. Colômbia (2016), Flor Freire v. Ecuador (2016) and Advisory Opinion 24 (2017). Other international instruments, including Council of Europe Convention 108, ILO's SOGIESC Discrimination Report and the Yogyakarta Principles plus Ten, support an LGBQA+ (lesbian, gay, bisexual, queer, asexual and other) inclusive interpretation of the LGPD's norm.

Gender identity as sensitive personal data

Gender identity is also not listed as sensitive personal data under the LGPD. However, unlike sexual orientation, most international data protection legislation does not recognize gender identity in their "sensitive data" lists. The absence of this term in data protection laws can potentially jeopardize the protection of a sizable portion of the LGBTQIA+ population. 

There is an ongoing debate on whether the LGPD's list of sensitive data is open or closed. If the list is open, we see no reasonable ground to not include gender identity as sensitive personal data considering its discriminatory potential. On the other hand, if the list is closed, it would exclude gender identity from being considered sensitive data. We believe it is important to note we do not discuss whether gender identity should be encompassed by "sexual life," as this argument implies debating the essence of the concepts of gender and sexuality.

Under the Federal Supreme Court of Brazil's jurisprudence, "gender identity discrimination" fits within the concept of racial discrimination. Logically then, the term "gender identity" should fit within the idea of race. Under the LGPD, "race" is considered sensitive personal data. Therefore, under the court's ruling, "gender identity" is encompassed under the concept of sensitive personal data.

In March 2004, the court ruled habeas corpus 82.424/RS. In that case, the majority of justices ruled the concept of "race" is not "simply biological [and] isolated"; instead, it "derives from its anthropological valuation and its sociological aspects." The court further held "there is no biological basis for what people describe as race," noting "racism, far from being based on the simplistic concept of race, actually reflects reprehensible behavior that stems from the conviction that there is a hierarchy among human groups, sufficient to justify acts of segregation, interiorization, and even elimination of persons." 

In June 2019, the court reiterated its position in ADO 26 (direct action to declare unconstitutionality by omission) and MI 4.733 (court injunction) when ruling if discrimination based on sexual orientation and gender identity could be considered racism. The court upheld its previous interpretation that "race" is a multi-layered concept. It explicitly recognized both sexual orientation and gender identity discrimination as racism under the Anti-Racism Law. One justice noted "the usual meaning of race as a purely biological expression cannot be lent in isolation," noting "[w]hat [Brazilian] Constitution seeks to curb is an interiorizing discrimination, which it repudiates under the alias' racism.'"

According to the court, race is more than strict biological aspects and how people look, but rather a "manifestation of power, from a historical-cultural construction." This idea was at the core of the 2019 court decision. If racism encompasses discrimination based on gender identity, "race" encompasses gender identity, as well. The same argument applies to sexual orientation.

Conclusion

We do not aim to exhaust all arguments on the relationship between LGBTQIA+ rights, non-discrimination and data privacy but to create further debate over the matter. Even so, we can draw some conclusions from these arguments.

First, a data protection law must be addressed from a human rights perspective, protecting vulnerable communities, such as the LGBTQIA+ population. Second, a diversity-prone interpretation of a data protection law allows countries to restrain discriminatory or abusive data processing against minority groups. Third, sexual orientation should be considered sensitive personal data under the LGPD because "sexual life" encompasses "sexual orientation." Fourth, gender identity should be regarded as sensitive personal data according to Brazilian Supreme Court's jurisprudence defining "racism" and "race." Fifth, the fourth conclusion fully applies to sexual orientation.

This debate has untapped aspects and plenty of room to grow. We expect the interpretation of data protection laws and their consequences over non-discrimination to mature, while minority groups seek recognition under these legal protections. Though underlying biases still exist and laws are blind to minorities' challenges, the legal community ought to keep these debates ongoing.

Photo by Tim Bieler on Unsplash