The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 make specific provision for processing of personal data relating to criminal convictions and offences. This processing – including the sharing of such information - shall be carried out only where specifically authorised by law or under the control of official authority.
In some specific instances criminal conviction information may be provided in a public arena - this is most likely to be in open court at a sentencing hearing. Anyone attending this hearing will therefore have access to this information. However, thereafter, no organisation should provide the information to a third party without lawful authority as to do so may mean they are in breach of the Data Protection Act.