I don't think any of these defamation cases have much to do with the GRA.
The individual could argue that revealing past names was transphobic harassment (and has done so) but it wouldn't be harassment unless it caused serious harm to their repution.
The information in the harassment case linked to in the OP would show up on anything more than a basic DBS.
DBS rules for trans applicants are here:
www.gov.uk/guidance/transgender-applications
Although it says this procedure is 'in accordance with' the GRA, it doesn't seem to be necessary to have a GRC to make use of it. Basically if you don't want to have previous names and 'genders' revealed on the form to your employer, you ring the sensitive applications team and they presumably add any previous convictions to your current name.
Obviously if 'Sally' has a rape conviction it's a bit of a giveaway.
This is relevant to one of the cases I linked earlier - Trans offender seeks to wipe crimes as a man from record
www.thetimes.co.uk/article/trans-offender-seeks-to-wipe-crimes-as-aman-from-record-qfk5w68lb?shareToken=eaa0f0a44d245a04abfee73a82bbe40a
The government guidance doesn't say what happens if you don't follow the 'sensitive applications' route and just don't declare previous names on the form - presumably the same as any other person who has changed their name and doesn't declare. I'd hope the police would be onto that.
What are MLR and KYC?