The Brazilian Data Protection Law for LGBTQIA+ People: Gender identity and sexual orientation as sensitive personal data/A Lei Geral de Proteção de Dados Brasileira para Pessoas LGBTQIA+: Identidade de gênero e orientação sexual como dados pessoais sensíveis.
| Autor | Souza Dantas Fico, Bernardo de |
1. Introduction
In a data-driven economy, technological advancements (e.g., predictive data mining tools, machine learning, and artificial intelligence) constantly widen and deepen the challenges to the enjoyment of fundamental rights and civil liberties. For instance, research concerning the possible impacts of automated data processing techniques by the Committee of Experts on Internet Intermediaries ("MSI-NET") of the Council of Europe concluded that algorithms risk violating or undermining the enjoyment of a range of human rights, including, inter alia, the rights to privacy, to a fair trial, to freedom of expression, freedom of assembly and association, and non-discrimination (MSI-NET, 2018). The materialisation of these and other risks related to technological advancements can already be seen worldwide with varying degrees of complexity. In Egypt, since at least 2014, information collected from social networks and dating mobile apps have been used to identify and detain members of the LGBTQIA+ community (TANRIVERDI, 2014). As reported by the Human Rights Watch, this practice is often followed by torture, inhuman and degrading treatment and punishment, denial of medical care, denial of legal counselling, among other violations (HRW, 2020). In this multi-layered reality, data protection laws are instrumental in securing the enjoyment of fundamental liberties and rights.
The recent Constitutional Amendment no 115/2022 recognised the right to data protection as a fundamental right in the Brazilian legal system (BRAZIL, 1998, Art. 5 LXXIX). The regulation of this right is primarily based on the Federal Law no 13.709/2018, often referred to as the Brazilian General Data Protection Law (from Portuguese, "LGPD") (BRAZIL, 2018). This law categorises information into two groups: "personal data" and its subcategory "sensitive personal data." The former refers to any "information regarding an identified or identifiable natural person" (authors' translation) (BRAZIL, 2018, Art. 5 I) whereas the latter comprehends personal data "concerning racial or ethnic origin, religious belief, political opinion, trade union or religious, philosophical or political organization membership, data concerning health or sex life, genetic or biometric data, when related to a natural person" (authors' translation) (BRAZIL, 2018, Art. 5 II). The LGPD does not define sensitive personal data, simply listing the categories of data that are encompassed. Nonetheless, LGPD acknowledges a grey zone of personal data "that reveals sensitive personal data and that may cause harm to the data subject" (authors' translation) (BRAZIL, 2018, Art. 11 [section] 1) and shall only be processed under one of the legal bases applicable to sensitive data. Similar to the European General Data Protection Regulation ("EU GDPR") (EUROPEAN UNION, 2016, Art. 9), LGPD's rules for processing sensitive personal data are generally stricter than for processing non-sensitive data.
Confronted with the absence of sexual orientation and gender identity on LGPD's list of sensitive personal data, the second section of this article will argue that the legal concept of sensitive data has certain shortcomings. These include but are not limited to i) defining the practical limits between personal and sensitive data, ii) being influenced by socioeconomic and cultural paradigms reflected in society when a law is enacted, and iii) risking an underinclusive protection. The third section will argue that "sex life" can be interpreted in different ways, but a human rights-based interpretation is the only one compatible with national and international law, and it mandates the inclusion of "sexual orientation" and "gender identity" within the concept of "sex life." In addition, the fourth section argues that the Brazilian Supreme Federal Court (from Portuguese, "STF") jurisprudence also independently provides a solid basis for "sexual orientation" and "gender identity" to be recognized as sensitive data under the alias of "race", despite STF's rulings not having concerned data protection. The fifth section consolidates the interpretation that "sexual orientation" and "gender identity" are sensitive personal data under LGPD's article 5 II. Finally, the sixth section indicates some of the social and individual benefits of having "sexual orientation" and "gender identity" be considered sensitive personal data.
Prior to developing each argument, two preliminary remarks are necessary. First, mindful of the different interpretations of sexual orientation and gender identity proposed by scholars, this article will adopt by default the legal definitions proposed by the Yogyakarta Principles:
UNDERSTANDING 'sexual orientation' to refer to each person's capacity for profound emotional, affectional and sexual attraction to, and intimate and sexual relations with, individuals of a different gender or the same gender or more than one gender; UNDERSTANDING 'gender identity' to refer to each person's deeply felt internal and individual experience of gender, which may or may not correspond with the sex assigned at birth, including the personal sense of the body (which may involve, if freely chosen, modification of bodily appearance or function by medical, surgical or other means) and other expressions of gender, including dress, speech, and mannerisms; (YOGYAKARTA, 2006) Second, the authors recognize that the LGBTQIA+ population is not homogeneous: individuals experience their sexual orientation and gender identity differently, and other social markers influence how each person enjoys their fundamental rights and liberties. (1) However, these differences should not prevent the analysis of aspects that are universal to them.
2. Limitations of Sensitive Data in Current Data Protection Laws
While the broadness of LGPD's legal definition of personal data fostered the hitherto embryonic Brazilian culture of data protection, the separation between the categories of personal data and sensitive personal data is not without criticism. Accordingly, this section will go on to address three of them: i) the limits between sensitive and non-sensitive data, ii) the existence of legislative bias when defining which information is "sensitive," and iii) the use of open and closed lists of sensitive data. The authors highlight that these critiques are not exhaustive.
2.1. The Limits Between Personal and Sensitive Data
The dichotomy between sensitive and non-sensitive data fails to confront and resolve concerns imposed by modern technologies. Two examples provide insights on the problem. Researchers of the University of Cambridge and Stanford University have demonstrated that computer models are able to predict characteristics related to one's personality based on their digital footprint. These characteristics include information concerning "depression, political orientation, [...] impulsivity, values, [...] substance use, physical health" (YOUYOU; KOSINSKI; STILLWELL, 2015, p. 1038), and others. Meanwhile, researchers of the University of Saskatchewan concluded that emotional states (e.g., confidence, hesitance, nervousness, relaxation, sadness, tiredness, and anger) can be deduced from a person's keyboard typing patterns (EPP; LIPPOLD; MANDRYK, 2011, p. 715-724). However vivid and contentious it might still be the academic debate on the challenges posed by modern technologies, it follows from these two examples the lesson that current technology already allows, inter alia, non-sensitive personal data to be used as a proxy for sensitive data. Consequently, modern data processing practices blur the lines that separate these categories, regardless of how clear the distinction on paper may arguably be.
As it stands, the fluid limits between the categories of personal and sensitive data open a margin for inadvertent and deliberate misuse of personal information. Different scenarios can be imagined for illustrative purposes. As an example, take a social network with all of its data protection obligations met, and that seeks to direct advertisements to consumers of a particular ethnic group. For users that are prone to disclose their ethnicity, said social network could lawfully collect this sensitive data on the ground of the free, unequivocal, informed, specific, and highlighted consent of users (BRAZIL, 2018, Art. 7 I). Conversely, some users will be unwilling to provide said information, leading the social network to one of two options. The first option would be to attempt to predict users' ethnicity based on their non-sensitive online footprint (CHEN et al. 2017). For instance, while geolocation is not per se a data listed as sensitive by LGPD, it might indicate one's ethnicity in cities where ethnic groups are highly segregated to particular neighbourhoods. However, the lawfulness of this prediction would depend on fulfilling LGPD's legal bases applicable to the processing of sensitive data (BRAZIL, 2018, Art. 11), because sensitive information was inferred. The second option would be to process the same non-sensitive online footprint without actually drawing the inference. Once no sensitive data is used, and arguably no harm has been caused to the data subject, the social network could legally justify the ethnically targeted advertisement on the grounds applicable to non-sensitive data processing (BRAZIL, 2018, Arts. 7 and 11 [section] 1). The above-described scenario is not detached from reality. In 2015, Universal Studios used Facebook's tool "racial affinity targeting" to show users different versions of the trailer for the movie "Straight Outta Compton'' according to their ethnicity (HERN, 2016).
2.2. The Legislative Bias
While the scope of this article is not to assess the extent to which the Brazilian National Congress has accommodated social diversity and pluralism, its under-representation is well documented and creates legislative biases. By analysing the Brazilian Superior Electoral Court's...
Para continuar a ler
PEÇA SUA AVALIAÇÃOCOPYRIGHT GALE, Cengage Learning. All rights reserved.
