Section 22 of Gender Recognition Act 2004 (GRA) provides stringent privacy protections for Gender Recognition Certificate (GRC) holders, aimed at protecting the privacy of those whose transition would otherwise not be immediately obvious. The 2004 Act creates criminal offences for anyone disclosing any information about a person’s past identity, or current status as a GRC holder, if that knowledge is gained in an official capacity. There are some limited exceptions, for instance, it does not apply for the purposes of the investigation of a crime, and more limited protection for applicants covering only their application.

The Gender Recognition Reform (Scotland) Bill has the effect of extending the number and type of people covered by Section 22. By virtue of moving GRCs to a self-declaration model, the protection of s22 will become much more easily available and is therefore expected to be extended to a much larger and more diverse group of people.  Further, for the first time, it will cover any person claiming already to have obtained the equivalent of a GRC overseas. It will also mean that applicants benefit from their more limited protection for two years, even where they decide not to take the final steps needed to complete the GRC process. 

Against this background, this blog looks at how organisations currently interpret the law and how the Scottish Government has reneged on a previous commitment to tighten the law in this area, and is instead proposing to widen its scope.

The current law: institutional caution and over-interpretation

Understandably, many organisations are hesitant about falling foul of s22 and this is evident in policies and guidance. What is also clear is that employers and service providers, including health authorities and police forces, are over-interpreting s22 to cover not just GRC holders but any person with a self-declared trans identity, as shown below.

Mental Welfare Commission in Scotland

In August 2022, the Mental Welfare Commission in Scotland issued an updated good practice guide for staff working in mental health wards, community and primary care services, aimed at raising awareness of the rights of LGBT people.

Under the sub-heading entitled ‘What can you do as a practitioner in the field of health and/or social care?’, this states in emboldened text that practitioners should “Be aware that sharing a person’s transgender status without their permission is an offence under the Gender Recognition Act 2004.”

NHS Forth Valley

NHS Forth Valley’s ‘Supporting transgender staff in the workplace: protocol and guidance’ states:

“If a person has a Gender Recognition Certificate or it could be assumed they might have a Gender Recognition Certificate (for example they are living permanently in their affirmed gender), then this cannot normally be disclosed further in a way which identifies the person involved without that person’s express consent or, more exceptionally, a specific order by a court or tribunal.” [our emphasis]

NHS Lothian

Under ‘10 Top Tips for Employers’, NHS Lothian’s ‘Transgender Workplace Support Guide’ states, again in emboldened text:

‘Remember confidentiality: it is an offence to disclose that someone is transgender without their permission.’

This point is reiterated several times throughout the document.

British Transport Police

The British Transport Police ‘Gender Diversity & Reassignment (Transitioning at Work)’ policy states that employers should seek legal advice when handling an employee’s GRC, and that the 2004 Act precludes disclosure if there is ‘a strong suspicion or likelihood’ that the individual holds a GRC (emphasis added). 

It is very important to recognise that whether a person has a Gender Recognition Certificate or not to ensure that there is no discrimination against Trans people and disclosure of their status should not be made unless the legal status of their sex is directly at issue.

It is particularly important to note that it is not permitted to ask to see or request a copy of a person’s Gender Recognition Certificate. The GRC, if one is held, must be offered unprompted by the holder of the certificate of their own volition. It is not appropriate for a copy of a GRC to be made in most instances unless in exceptional circumstances. Legal guidance should be sought in this instance.

Under Section 22 of the Gender Recognition Act 2004 it is not permitted to disclose an individuals’ transgender status where there is a strong suspicion or likelihood that the individual holds a Gender Recognition Certificate. It is also not permitted to refer to GRC’s in any correspondence or on our HR Data Warehouse systems or on the individuals’ personnel file, unless that file is sealed as detailed in Sections 5 (Changes to Records) and 8 (Disclosure & Guarantees of Confidentiality) of this MoG. It is also not permitted to make any other references that could infer a transgender status unless directed to do so in writing by the employee / individual. In all instances, we must refer to an individual as the gender that they present as or wish to be referred to.

National Gender Identity Clinical Network for Scotland

Giving evidence on the Gender Recognition Reform Bill to the Equalities, Human Rights and Civil Justice Committee, the Lead Clinician for the National Gender Identity Clinical Network for Scotland stated:

“One thing that has always been important and which was touched on in one of the committee’s earlier evidence sessions is privacy regarding gender identity, which is covered in section 22 of the Gender Recognition Act 2004. My colleagues in the network and I have always taken the position that we treat everybody as if they have a GRC, because that affords people the right amount of privacy.”

The privacy problem: why it matters

The privacy provision in s22 raises a significant challenge for the operation of the Equality Act 2010, effectively providing an ‘invisibility cloak’ for the characteristic of sex for one group of people.  

The Employment Lawyers Association (ELA) submission to the UK Government’s 2018 consultation on reform of the GRA focuses principally on Section 22, setting out strong concerns about the 2004 Act. The ELA argue that:

• The lack of mental element/mens rea risks criminalising accidental disclosure:

‘Whilst there are acts which are properly characterised as criminal (violent hate crime being  an obvious example) it is disputed that a disclosure of information properly so amounts.

This is particularly because of the lack of mental element required in order for there to be a breach of section 22: there is no need for the disclosure to be malicious or in any way intended to harm the trans person. Indeed the disclosure may be with the express intention of helping the trans person (and indeed may in fact help them) but would still amount to a criminal offence.’

• The provision is inconsistent with discrimination law/protection afforded to those with other protected characteristics:

‘the existence of section 22 as a criminal offence is inconsistent with the UK’s longstanding approach to discrimination. The UK has, since the Sex Discrimination Act was passed in 1975, focussed on discrimination as a civil wrong, with remedies i’cluding declarations, recommendations and orders for compensation. That protection has been expanded since then to all the protected characteristic now contained in section 4 EqA 2010, of which “gender reassignment” is one.

The anomaly that is section 22 means that a different approach is taken as regards one specific protected characteristic as compared with others.’

• It is inconsistent with the law in respect of other data disclosures:

‘Section 22 GRA 2004 is also inconsistent with other legislation, such as the Data Protection Act 2018 (DPA 2018). With some limited exceptions (that are not relevant here) breach of the DPA 2018 does not have criminal consequences./

•  The provision may disadvantage trans people in relation to employment:

‘Concerns about accidentally breaching section 22 GRA 2004 may also mean that employers are less willing to be flexible in their recruitment processes, for example in respect of what documentation they ask for. Where there is a risk of staff inadvertently incurring individual criminal liability, experience suggests that employers will seek to protect staff by insisting upon adherence to strict internal guidelines which deter management from using their initiative to better assist individual applicants.’

• It places undue restrictions on the rights of others:

‘it will sometimes be necessary, and certainly legitimate, for others to refer to matters that pre-date the issuing of a GRC which could have the impact of disclosing the GRC holder’s gender before they acquired a GRC. In our view they should not have to risk criminal sanctions by doing so.’

The ELA conclude that the current provision in the 2004 Act should be repealed or remodelled to only cover malicious or unreasonable disclosure.

‘ELA’s proposed solution is simple: repeal Section 22 GRA 2004. Concerns about malicious disclosure can be amply dealt with by the harassment provisions contained in the Equality Act 2010, which also have the advantage of meaning that the injured person can receive compensation. Alternatively, section 22 2004 be amended to ensure that only disclosures that are malicious, or intend to do harm, and are not reasonable, are covered. In addition, the existing exemptions need to be expanded to address the situation set out below. Section 22 GRA 2004 is not workable in practice and is likely to have unintended consequences.’

The concerns set out by the ELA are not abstract. For example, in some instances, individuals may wish to request that the care they are provided with is delivered by someone of the same sex.  

In January 2022, the chair of a parent support group for children with profound learning disabilities wrote to Cabinet Secretary for Social Justice Shona Robison voicing concern about their ability to ensure that the intimate care needed by their children would be delivered by same-sex carers. Other parents have voiced similar concerns.

In December 2018, one of the largest health boards in Scotland, NHS Lothian confirmed to a women’s group that, due to s22 of the GRA, they were unable to guarantee that a woman healthcare worker – if requested by a patient – would be someone who is biologically female.

‘Unless the practitioner consented, to exclude them from carrying out female-only care would be a breach of section 22 of the Gender Recognition Act 2004, and a criminal offence. There are also restrictions under the Equality Act 2010 around requiring staff to disclose their gender identity and staff selection on this basis.’

‘For these reasons, NHS Lothian does not have any policy to guarantee that a legally female member of staff carrying out female-only care as requested by a patient, will be biologically female.’ [our emphasis]

Closing the privacy gap?  

In its 2019 consultation on gender recognition reform, the Scottish Government appeared to recognise that Section 22 needed updating. It committed to considering further exceptions to the privacy provision, providing guidance on the use of Section 22, and stated that it would outline its approach on the introduction of any Bill:

‘One point which might arise when using the general occupational requirements exception is that some people in an organisation (eg people in its HR department) may know about a person’s trans history but those actually taking the decisions on staff deployment (eg line managers) may not. In these circumstances, and when there is a legitimate case to use the general occupational requirements exception, the Scottish Government considers that it would be appropriate for information about a person’s trans history to be shared in a strictly limited, proportionate and legitimate way.

To facilitate this, the Scottish Government will consider before any Bill to reform the GRA is introduced to Parliament if:

• Further exceptions to section 22 should be made, by way of a further Order under section 22(6).
•  Scottish Government guidance on section 22 should be issued.

We will outline our approach in this area when any Bill is introduced into Parliament.’ (2019: 34)

UK Government amendments

In late 2021, the UK Government brought forward a statutory instrument to amend s22 so that it is no longer an offence in England and Wales to disclose information about a person’s GRC status for the purpose of the management of offenders.

In June this year, s22 was amended for England only to allow  those undertaking the Cass Review [1] to disclose protected information to each other, during the course of their work.

Compounding the problem: The Gender Recognition Reform (Scotland) Bill

As outlined above, s22 under the current Act is already problematic. Rather than repeal or create further exceptions to s22, as the UK Government has done, the Scottish Government’s proposals will widen the scope of those whose status will be treated as ‘protected information’. In conjunction with the move to a self-declaration model, this will compound the existing risks by extending the provisions to a wider and more diverse population, including many more people whose sex is evident, and increase the scope for risk in relation to identity fraud.

Extending to overseas applicants

The Bill proposes that people who have already obtained gender recognition overseas, under any system, are automatically treated as if they had obtained a GRC here, with no specified evidence requirement, including for the purpose of Section 22. Entitlement to these protections on this basis will therefore be easy to assert and it is not immediately clear how that would be confirmed by any organisation on the ground.  At present, overseas gender recognition is only available to those from a limited number of countries, which have comparable systems to the one in the GRA 2004 as it stands, and requires a formal GRC application, albeit via the more streamlined “overseas track”. 

This parliamentary exchange shows a remarkable degree of government complacency and lack of response to a relevant question on the implications of opening up the protections of s22 much more widely to those from overseas.

Maggie Chapman:  My question is around section 22 of the GRA. An issue of potential concern has been put to us about overseas gender recognition and confirmatory GRCs. Although there is no obligation for somebody with overseas gender recognition to obtain a confirmatory GRC, does the lack of a requirement for any evidence to be provided about that give you any cause for concern in relation to people who have a GRC from somewhere else in the world coming to Scotland? How difficult would it be for employers to obtain information that comes under the protected information provisions of section 22? My question is around concerns for employers gaining access to information that they might need in relation to things such as safety for people.

Shona Robison: Given that, as a general principle, a GRC obtained overseas would be recognised in Scotland, confirmatory GRCs should not, in theory, be widely needed. The bill provides for them in cases in which someone is having difficulty obtaining that recognition or wants clear evidence of the legal recognition of their lived gender—that might apply to someone fleeing a war-torn country, for example, where they do not have access to records. It will be a tiny number of cases, but the provision has such things in mind, as I understand it. Is that right, Peter?

Peter Hope-Jones: Yes. Colin Gilchrist can comment on that.

Colin Gilchrist (Scottish Government): The Fukushima nuclear disaster in Japan resulted in various records being destroyed or irretrievable. That was the type of example that was used in considering the confirmatory GRC provisions— complete destruction of the records in a different country.

Scottish Parliament Equalities, Human Rights, and Civil Justice Committee, 28 June 2022

Identity fraud risks

Human rights campaign group, Sex Matters, point out that the combination of shifting to a self-declaration model of legal sex change and s22 of the GRA creates the potential for domestic and international identity fraud, given that individuals from outside Scotland will be able to obtain a GRC based simply on claiming to have obtained formal gender recognition as the opposite sex in another jurisdiction.

Extended protection for applicants

The draft Bill has the practical effect of extending the privacy protection relating to the fact of an application to cover applicants for longer. As now, this protection starts at the point of application (information of which is protected). Under the Bill, if an applicant does not immediately confirm their intention to proceed with a GRC after their application is initially processed, their application remains live for two years. The privacy protection remains in place throughout.

The law as written vs the law in practice

Part of the problem here, as in other areas of the Bill, is that Scottish Government does not appear to recognise the sizeable gap between the law as written and its interpretation by employers and service providers, and that s22 already impedes organisational decision-making, as outlined above. 

In response to a parliamentary question on 3 March 2022 from Claire Baker MSP about the interaction with the Equality Act 2010 and whether s22 could make it harder to use the general occupational requirement exception, Cabinet Secretary Shona Robison failed to clarify whether guidance would be specifically issued in relation to s22,

Claire Baker: I want to ask about the interaction between section 22 of the Gender Recognition Act 2004 and the 2010 act exceptions. The consultation on the draft bill noted that a question was raised about whether section 22 of the GRA could make it harder to use the general occupational requirement exception. In a letter to me in November, the cabinet secretary said that the Government would consider whether further exceptions to section 22 should be made and whether the Government would issue guidance on section 22. No changes seem to be proposed in the bill that was introduced yesterday, so does the cabinet secretary intend to issue guidance? Would the guidance be issued during the progress of the bill?

Shona Robison: First, guidance will be issued on a number of elements of the bill.

Let me be clear about the general occupational requirement exception. That does not change, because it is part of the Equality Act 2010. I can provide an example. If someone was working in the field of providing intimate care, it is, as is the case at the moment, absolutely legitimate for a patient or someone receiving social care to say who they do and do not want to provide that service. That is underpinned by the general occupation exception under the 2010 act. This bill does not change that at all. It remains as was. The important thing that I said in my statement was that the bill does not take any rights away.

Conclusion

The draft Bill suggests that the Scottish Government has either not seriously considered, or dismissed the possibility that a self-declaration model of gender recognition might exacerbate the existing problems with s22, or be attractive to anyone wishing to hide any form of difficult history, whether criminal or financial or otherwise, and provide an incentive for self-declaration.

More broadly the Scottish Government appears relaxed about extending its scope. In giving evidence to the Scottish Parliament, an official accompanying the Minister stated that concerns about s22 exception might be dealt with further down the line:

“On the section 22 exceptions, it is probably true that we are generally open to conversations about whether additional exceptions are needed in section 22. However, our view is that this bill would probably not be the best way to do that, given that it is focused on the process for obtaining a GRC, not on the effect of a GRC.”

This is an astonishing admission. The Scottish Government’s first consultation on GRA reform was published in autumn 2017, meaning that it has had well over five years to consider how to update Section 22. It promised in 2019 to consider further how it might address existing concerns about it having a larger effect than was intended. It now seeks to defer into some unspecified future process the work of dealing with those existing concerns, while asking the Scottish Parliament to agree legislation which will widen its impact in ways the Policy Memorandum to the Bill does not even discuss. This is an amateurish approach to law-making and, as with so much in this Bill, leaves it to MSPs to prove that the Parliament is capable of compensating for short-comings in government.

---

Notes

[1] The Independent Review of Gender Identity Services for Children and Young People (The Cass Review) was commissioned by NHS England and NHS Improvement in Autumn 2020 to make recommendations about the services provided by the NHS to children and young people who are questioning their gender identity or experiencing gender incongruence.