The privacy clause of the GRA is serious and imposes a burden on public service providers, even when the existence of a GRC is in doubt
But doesn't the privacy clause only operate when a person has acquired information that the person has a GRC?
www.legislation.gov.uk/ukpga/2004/7/section/22
(1)It is an offence for a person who has acquired protected information in an official capacity to disclose the information to any other person.
(2)“Protected information” means information which relates to a person who has made an application under section 1(1) and which—
(a)concerns that application or any application by the person, or
(b)if the application under section 1(1) is granted, otherwise concerns the person’s gender before it becomes the acquired gender.
(3)A person acquires protected information in an official capacity if the person acquires it—
(a)in connection with the person’s functions as a member of the civil service, a constable or the holder of any other public office or in connection with the functions of a local or public authority or of a voluntary organisation,
(b)as an employer, or prospective employer, of the person to whom the information relates or as a person employed by such an employer or prospective employer, or
(c)in the course of, or otherwise in connection with, the conduct of business or the supply of professional services.
If they simply know the person's sex, and have not been informed that they have a GRC, this is not protected information. If the person does have a GRC it becomes protected information, which means that NHS staff in cases like this are obliged to lie to other patients if the transgender person with the GRC has not consented to having that information shared.
This is a problem and the law needs to be changed.