Transgender Protection of Rights Act 2019 (and the 2026 Amendment)

After the introduction of the Guidelines, the 2019 Act was introduced, and hailed as a watershed movement in ensuring equality of transgender people. It looked to operationalise the Supreme Court's verdict in NALSA, but has since been heavily criticised,¹ and fits cleanly within our three-pronged "technology of security" framework. The Act undertakes a paternalistic tone by framing itself as an "Act to provide for protection of rights of transgender persons and their welfare and for matters connected therewith and incidental thereto."

Now, on documentation and legibility. The 2019 Act defined "transgender" in an inclusive manner as "a person whose gender does not match with the gender assigned to that person at birth and includes trans-man or trans-woman, whether or not such person has undergone Sex Reassignment Surgery." The definition itself is remarkably inclusive—and fulfils the constitutional requirements under NALSA—but was subject to operational lacunae. Whereas the first application for a "transgender certificate"² could be on the basis of self-determined gender, the change in gender (i.e., recognition as male or female) requires that SRS occur, and the change of gender certificate be provided to the District Magistrate who should be "satisfied with the correctness" of such certificate. Critics argued that this is effectively insistence on SRS, which has been held to be illegal and immoral in NALSA,³ and threaten to conflate the medical and the legal. Insofar as the power to determine legitimacy of an individual's gender identity rests with the state, the individual no longer is able to freely self-determine without the influence of the state—a violation of the privacy of the individual as determined by the Supreme Court in Puttuswamy.

The third part on criminalisation. Much of the criminalisation of the 2019 Act extends to determination of what constitutes a valid form of kinship,⁴ and mandates their presence in rehabilitation homes where necessary,⁵ both of which somewhat contradict the principles outlined in Puttuswamy. However, the larger constitutional questions emerge from the attempt at mass documentation of transgender people.

Creation of a mandatory "transgender certificate," involves mandatory disclosure of one's gender identity. Therefore, similar to the blood donation guidelines, we subject this to the scrutiny of the Puttuswamy test. Whereas the aim of protecting transgender rights is a legitimate state aim, and the introduction of the Act is legally permissible, the primary question is whether a mandatory certificate is necessary and proportionate to the state's aim of protecting transgender rights.

The 2019 Act does two things: (1) outlines what constitutes discrimination of transgender people, and prohibits the same, and; (2) enables "appropriate governments," to undertake welfare measures for transgender people.⁶ The introduction of the transgender certificate as a precondition for the applicability of both (1) and (2) is disproportionate. That is, whereas it is reasonable and proportionate for identification to be mandatory for welfare delivery, the 2019 Act itself does not provide for any direct welfare or associated benefits, and "welfare" under the Act is limited to an enabling clause. The actual welfare delivery happens through subordinate legislation and executive action entirely outside the Act's own operative provisions. This means the certificate the Act creates serves, within the four corners of the Act itself, only two purposes: (1) recognition of identity, and; (2) protection from discrimination.

Now, it is neither necessary, nor proportionate to have to provide separate identifiers for prevention of discrimination. That is to say, the root of anti-discrimination law is the intent of the discriminator, not the actual identity of the victim. That is, for instance, in the case of an SC/ST Prevention of Atrocities proceeding, the caste certificate aids in establishing that the victim was indeed a member of the SC/ST community,⁷ but establishing the commission/abetment of a cate-based offence requires the establishment of intent of the accused to do so.⁸ Put simply, establishing (and thereby preventing) discrimination of a member of a SC/ST community requires that two elements be fulfilled: (1) the person has a valid certificate indicating their membership within such community, and; (2) the discrimination occurred on the basis of the caste itself. As recognised in NALSA, gender identity is self-determined unlike caste, and therefore the existence of a certificate is immaterial—what matters is whether the discriminator acted on the basis of that perceived identity. The necessity of a transgender certificate as a means to operationalise rights granted under this Act stands in direct contravention to the principle of self-determination, and conditions anti-discrimination statutes on state recognition of gender identity.

The 2026 Amendment changed none of the negative elements of the 2019 Act, and instead removed some protections granted to transgender people. The three-pronged technology of security division remains broadly unchanged, with some modifications to documentation and legibility. Take the Statements of Objects and Reasons of the 2026 Amendment, which states:

"The legislative policy was and is intended to protect only those who face severe social exclusion due to biological reasons for no fault of their own and no choice of their own [...] It is therefore imperative to give a precise definition for proper and definitive identification and protection of transgender persons to whom the benefits of the Act must reach. [...]care has to be taken that such identification cannot be extended on the basis of any acquirable characteristics or personal choice or claimed self-perceived identity of an individual."

The implications are alarming. Firstly, this rests on the assumption that acts of discrimination and associated social exclusion of transgender people occur solely on the basis of verified biological/community identity, as opposed to perceived identity—extrapolated from the manner in which a person acts or looks.

Second, inasmuch as a person's gender identity/sexuality is an innate and private affair, control over such information should rest solely with such person. The phrase "...legislative policy was and is intended to protect only those who face severe social exclusion due to biological reasons for no fault of their own and no choice of their own," implies that the state is in a position to adequately determine whether an act of discrimination or social exclusion on the basis of an individual's gender identity (in this case their identity as transgender) was the "fault" of the victim, and therefore whether the victim deserves protection under the legislation. That is, the state now has the power to determine whether an individual's gender identity is "legitimate," and consequently deserving of legal protection, which, as discussed under the 2019 Act, stands in contravention of the Supreme Court's judgment in Puttuswamy.

The 2026 Amendment first narrows the definition of "transgender," to include those who are transgender by virtue of congenital variations in sex characteristics, those who are born into socio-cultural communities like kinner, hijra, aravani and jogta, and those who have been forced/compelled to assume, adopt, or outwardly present a transgender identity, going so far as to specifically exclude those who are transgender by virtue of self-determined identities.⁹

Next, it replaces self-identification with a medico-legal framework to determine whether a person is transgender or not. First, Section 4(2) of the 2019 Act, which provides for self-determination of gender, has been omitted.¹⁰ Further, when a person applies for a transgender certificate,¹¹ the District Magistrate will only grant the same only after consulting the medical board established under the 2026 Amendment.¹² It also mandates those who undertake SRS after receiving a certificate under Section 6 to apply for a revised certificate, the receipt of which shall, once again be subject to the satisfaction of the District Magistrate.

Most concerning of all is the introduction of Section 7(1A) which mandates the medical institution that conducted such SRS shall automatically provide the details of such receiver to the District Magistrate.¹³ Read with the extremely state-centric data protection regime (refer here), principles of data minimisation and purpose limitation are subject to broad exemptions for the state, and such data may be used beyond the scope for which it was collected. Concerns¹⁴ have been voiced that the state's convergence with the Brahminical family unit, and the principle of interoperability of data could be used to create a "360-degree" surveillance of transgender persons, causing further stigmatisation due to hyper-visibility, and even further abuse at home due to potential disclosures to the family.

These breaches of privacy run the risk of certain life-threatening consequences, from outing gender identity, to exclusion of uncertified transgender people from protection, surveillance of the certified and policing of their behaviour, and a chilling effect on how all transgender people express themselves.

The language of the legislation may have changed—the state now purports to protect transgender people from the harms of society—but the State continues to render transgender identities legible through mandatory registration, monitor them through documentation, and regulate them through medico-legal control. In effect, the shift is merely semantic—moving from explicit "control" to bureaucratised "welfare"—while preserving the same surveillance-oriented architecture. India appears to be constructing an integrated surveillance architecture that enables the state to piece together a near-comprehensive profile of transgender individuals across administrative, medical, and welfare domains.

[4/4]

What Privacy-Centric Legislations Could Look like

The state wants to know who is transgender, decide who can be transgender, and determine their ideal behaviour. What changes across 150 years is only the register, the technology remains intact. This technology is both inadequate and violative of the basic tenets of privacy. The constitutional challenge here does not necessarily lie with disclosure of data to the state itself—the issue is actually the coercive architecture that renders such disclosure unavoidable for the exercise of basic rights. A privacy centric legislation must encompass the following considerations:

1. Privacy of personal data must be part of the regulatory architecture—i.e., as part of the legislative and operational design. SOGI must be opaque by design and transparent by choice.

2. The legislation should accommodate for self-identification of gender identity and minimise biocentric mandates—essentially respect the decision in NALSA.

However, we must also concede that no legislation can be operationalised without some degree of surveillance. However, the question is not whether the state gets the data of a transgender person or not, but under what conditions the state receives such data. An excellent example of a legislation that enables self-identification is Argentina's Gender Identity Law 2012,¹⁵ which accommodates for self-identification as the sole legal criteria for determination of gender identity, even explicitly stating that "in no case" is it necessary to prove that a person has undergone surgery for genital reassignment, hormonal therapies, or any other psychological or medical treatment to obtain legal recognition.¹⁶ Instead of creating an alternative identity system, the Law enables recognition of the transgender identity through self-identification within existing identity systems—even allowing for the free modification of relevant documents.¹⁷ These rights are further supported by a strict system of confidentiality—prohibiting disclosure of the previous gender identity or amendment of recorded sex without official authorisation.¹⁸

Germany, through its Act on Self-Determination with Regard to Gender Markers ("SBGG"), takes the logic of self-determination one step forward. It recognises the need to uncouple gender assignment and the choice of given names from assessments by third parties, extending its focus only to civil status, not gender affirming care or associated medical measures. Similar to Argentine law, non-consensual disclosure of previous gender identities is strictly prohibited¹⁹ barring special reasons such as criminal prosecution, security tasks, or if a substantiated legal interest exists.

While determining the ideal components of a privacy-centric transgender legislation, we must recognise that both Argentina and Germany are relatively smaller countries in terms of population and therefore the requirements for India are likely to be different in terms of scale. Further, the existence of sociocultural communities (such as hijras, kinners, jogtas etc.) must influence the manner in which legislations are enacted. Therefore, in sum, the legislation must prevent the creation of a permanent, state-readable identity class—which means no certificate-driven registry, no automatic data transfer, and no database that lets the state assemble a "near 360-degree" profile of trans lives by linking welfare, medical, and administrative records.

First, as opposed to creating a separate mandatory transgender certificate—which creates a state-legible database of transgender persons—the state must ensure that modifications to gender identity are done within existing citizenship documentation, while taking specific care to ensure that any information with respect to the citizen's gender information is not disclosed without consent or specific authorisation.

Second, the basis for modification of gender identity should be self-identification without the requirement for any medical/biological verification by the state. Self-identification should be enabled with minimal state intervention. Supporters of the 2026 Amendment raise concerns that self-identification can lead to fraudulent and repeated modification of gender identity for the sake of availing benefits under welfare schemes. The concern may be legitimate, but the fraud does not emerge from gender identity itself, but from capturing benefits, and a state that enables self-identification only does so to recognise legal identity. Welfare schemes may hold additional criteria—such as proof of vulnerability, income and unemployment.

Third, any data collected for welfare schemes must be scheme-specific, minimal, and deleted once the purpose is served—i.e., subject to strict data minimisation standards. Data Fiduciaries that collect SOGI for the purpose of welfare schemes may be classified as Significant Data Fiduciaries under Section 10 of the Digital Personal Data Protection Act 2023.²⁰

Fourth, automatic sharing of SOGI between entities that collect the same—hospital, welfare boards, Aadhaar-linked systems, and law-enforcement or family-facing databases—must be prohibited. Any form of interoperability that enables aggregation of identity data may facilitate the emergence of a unified, traceable dataset that could facilitate a "360-degree" view of transgender lives. Prevention of this is necessary and may be enforced using independent oversight, audit trails, and strict penalties for unauthorised disclosure.