Since 1998, under the terms of the revised Data Protection Act (1998) criminal conviction information relating to living individuals is categorised as ‘Sensitive Personal Data' and as such Police Scotland cannot provide/release this information to a third party. To do so would be a breach of the Data Protection Act and may render Police Scotland liable to prosecution.
In some specific instances criminal conviction information may be provided in a public arena - this is most likely to be in open court at a sentencing hearing. Anyone attending this hearing will therefore have access to this information. However, thereafter, no organisation should provide the information to a third party without lawful authority as to do so may mean they are also in breach of the Data Protection Act 1998.