apparently, it is not allowed to ask whether they do actually have [a GRC].
It is not illegal to ask if someone has a GRC. Not for private individuals, not for organisations.
Asking the question is not illegal.
What is illegal is to share with others that someone has a GRC if such information sharing is not warranted by the person holding the information.
So, in the prison context, it is legal to ask for documented proof of someone's legal sex. This can either be a birth certificate or a GRC.
(It cannot be a passport or driving licence, because they don't show legal sex only but can also show self-identified sex.)
It is also legal for the staff member who has been given that information to share this with prison officers and others working with this prisoner. It would not be legal for that staff member to share this information with visitors, journalists and staff members who have no need to know this.
The privacy protections written into the Gender Recognition Act make sense only in the context of transsexuals who are (as the EHRC calls it) "indistinguishable" from members of the opposite sex. It makes sense, because one purpose of the law was to protect the privacy of transsexuals who for all intents and purposes pass as members of the opposite sex. Every time they had to show proof that they were who they said they were, they had to also disclose their sex, even when that was irrelevant. Which was not only embarrassing but often led to direct discrimination.
The privacy protections written into the Gender Recognition Act make no sense in the context of someone who is indistinguishable from members of his or her own sex. But it's what we've got, and many organisations not understanding the law is causing harm to women.
I would like to see a legal opinion exploring the issue of what should happen when a male prisoner is transferred to the female estate. Women prisoners notice that this person is male and protest the inclusion of a man, albeit a man with the protected characteristic of gender reassignment, in their showers and public spaces.
If the prisoner has no GRC, there's no suggestion of any privacy restrictions and so prison staff are not required to gaslight the women and tell them this is a woman.
If the prisoner has a GRC, there's no suggestion in the Gender Recognition Act that the staff member privy to the information about someone's sex has to actively lie and deny their sex. They just cannot state outright "This is a man".
But do they have to lie to women prisoners and deny the male prisoner's sex? I would say no, but IANAL.