Here are the current rules:
www.gov.uk/government/publications/the-care-and-management-of-individuals-who-are-transgender
On the subject of determining legal sex, the policy framework says:
4.50 Arrangements must be in place to determine the legally recognised gender of all individuals at the first point of contact to inform assessments and decisions where binary (male/female) services are provided. Individuals who have gained legal recognition of their gender via a gender recognition certificate (GRC) can be issued with a new birth certificate in their acquired gender if their birth was registered in the UK.
4.51 Where a person’s gender is determined, the legal gender must be recorded on all case administration systems where ‘sex’ (male or female) is required.
4.52 Where ‘sex’ cannot be determined, staff must use the best information available, consulting with equality leads as necessary. Staff should avoid asking to see a GRC but instead request sight of a birth certificate as confirmation of legal gender where the person was born in the UK. Someone born abroad who has a UK-issued GRC may not have been able to obtain a new birth certificate in their acquired gender. A GRC is an acceptable form of proof of sex, if produced voluntarily. If an individual cannot produce a birth certificate, and have not chosen to provide a GRC, they may give permission for staff to check directly with the Gender Recognition Panel to confirm that a GRC has been issued.
4.53 Searching of the person must not be used as a means to determine gender.
Seek written consent to disclose the sex assigned at birth for individuals who are protected under the Gender Recognition Act 2004
4.54 All individuals who disclose that they have applied for, or have gained, a GRC must be asked to provide written consent for their gender which was assigned at birth, and/or details of the application process, to be disclosed to/from relevant staff in or on behalf of HMPPS. Consent is entirely voluntary on the part of the individual. The benefits of disclosure may be explained by staff, which include gaining a more informed approach in planning their care and management, and may also assist in gaining an increased understanding of the triggers for offending and to improve sentencing outcomes.
4.55 Systems must be in place to maintain records which are compliant with the Gender Recognition Act 2004 and do not identify a different gender or GRC application process where consent has not been given and where exemptions in s22 GRA 2004 do not apply. If consent is withheld, the previous gender and/or details of the application process must not be disclosed unless exemptions under s 22 of the GRA 2004 apply (see Legal Requirements section and supporting
operational guidance).
4.56 Staff can disclose previous gender and/or details of the application process only in the following exceptions to the offence in s.22 GRA 2004, which may be applicable to the prison context:
• s.22(4)(b) – the person has agreed to the disclosure
• s.22(4)(d) – the disclosure is in accordance with an order of a court or tribunal
• s.22(4)(e) - the disclosure is for the purpose of instituting, or otherwise for the purposes of, proceedings before a court or tribunal
• s.22(4)(f) – the disclosure is for the purposes of preventing or investigating crime
• s.22(4)(i) – the disclosure is in accordance with an Order under s.22(5), currently this is the Gender Recognition (Disclosure of Information) (England, Wales and Northern Ireland) (No. 2) Order 2005 which allows disclosure for, amongst others, purposes of obtaining legal advice, religious purposes, medical purposes.
• s.22(4)(j) – the disclosure is in accordance with any provision of, or made by virtue of, an enactment other than this section.
4.57 It is an offence for a person acting in an official capacity who has gained protected information relating to a person’s application for a GRC or information concerning the gender history of a successful GRC applicant to disclose the information to any other person. Unlawful disclosure is a criminal offence (Gender Recognition Act 2004, s22). All information sharing must be compliant with the GRA 2004, the GDPR and the DPA 2018.