Trans Privacy Law

This page answers some questions about legal protections for the privacy of trans people who give their information to services. If it doesn’t answer your specific question, call us for confidential advice on 020 7704 204. Galop is London’s lesbian, gay, bisexual and trans anti-violence charity.

Your right to privacy

Everyone has the right for their personal information to be kept safe by
organisations they talk to. On top of that, trans people have extra legal
protections if they have applied for a Gender Recognition Certificate (GRC)
to get the law to recognise their gender. Whether that applies to you or not,
organisations should treat you with respect, call you by the name you ask
them to use and not share your information without your consent except in rare
circumstances.

Keeping your information safe

The law can punish services that inappropriately share information about your gender, but it cannot undo harm caused by that information getting out, or stop friends, family or strangers from telling other people. If you decide to tell someone about your identity or history, it may be worth spelling out who you are happy for them to tell and who not. Also, remember that the internet is a public space and what you post online is not private.

Can an employer, service or business share my information against my wishes?

Not normally. Your personal information is protected by the Data Protection Act, article 8 of the European Convention of Human Rights and confidentiality case law. That means an organisation cannot normally give your sensitive information to anyone else unless you agree. However, there are times they can go against your wishes if it’s in your interest or the public interest. For instance it might be reasonable for an organisation to disclose something to the police if you or someone else’s life is at risk. They can only disclose information that is relevant though, and your gender history or trans identity is very unlikely to be relent in most situations. It is also illegal for a service or employer to ask if you have a GRC, because they should treat everyone the same regardless of their gender history. To challenge a service or employer about confidentiality you can get legal help from a solicitor, law centre or trade union.

Are there extra protections for trans people?

Yes, but only if you have applied for a Gender Recognition Certificate (GRC). You don’t need to have been granted one to be protected though. Once you’ve applied, section 22 of the Gender Recognition Act says that it’s illegal for representatives of public bodies, services, businesses or employers to share your previous name, gender history or trans identity without your consent. The difference is that it’s a criminal law so instead of you needing to hire a lawyer, the police should deal with it for you. If a court finds someone guilty, they get a criminal record and a maximum fine of £5000.

What’s the catch?

Unfortunately there are several conditions to receiving this legal protection. Firstly you must have a GRC. The person who disclosed your information must also believe or know that you have a GRC. There is also a six month time limit for the case to be investigated by police and for it to reach court after the crime was committed. That means you need to act quickly if you want to report it to the police. Lastly, there is a list of situations where this law cannot be used, such as where the disclosure was a legitimate part of crime investigation, legal proceedings or the social security system.

Who can it be used against?

The law can only be used against someone who found out about your trans* identity or gender history in an ‘official capacity’. That can include someone who receives the information through their role within a current or prospective employer, public or voluntary service, or business.

What situations are covered?

This law remains untested, but it could theoretically be used against people who share information internally within an organisation, such as a human resources worker telling your manager without your permission. It could also involve your information being shared with another organisation, such as an NHS worker telling a council worker. It could also involve a member of the public being told, such as your housing officer telling a neighbour.

How do I start the process?

You can report it to the police on their non-emergency number, 101. Privacy laws are not usually handled by the police so you might need to explain that section 22 of the Gender Recognition Act is a criminal law and the six month time limit means they need to act quickly. You can call us for help if you don’t get the response you want.

Which police force?

You need to report it to the police force that covers the area where the disclosure was made. For instance, if you live in London, but a worker in Kent disclosed your information by phone to someone in Surrey, you would report it to Kent Police.

How can Galop help?

• You don’t have to have experienced anything to get in touch – for example, if you’d like more information about anything in this leaflet, or advice about how to stay safe, we’d be happy to chat to you.

• If you want to discuss an experience of having your details disclosed, you can contact Galop in confidence via our telephone helpline service or online. Galop is run by the LGBT communities for the LGBT communities, so you’ll speak to a dedicated caseworker who will listen to what you say and take you seriously.

• If we are unable to help you directly, we can put you in contact with specialist advisors, for example, on housing or legal matters.