> "court records are public forever" and "records of crimes expunged after X years" are incompatible.

Exactly. One option is for the person themselves to be able to ask for a LIMITED copy of their criminal history, which is otherwise kept private, but no one else.

This way it remains private, the HR cannot force the applicant to provide a detailed copy of their criminal history and discriminate based on it, they can only get a generic document from the court via Mr Doe that says, "Mr Doe is currently eligible to be employed as a financial advisor" or "Mr Doe is currently ineligible to be employed as a school teacher".

Ideally it should also be encrypted by the company's public key and then digitally signed by the court. This way, if it gets leaked, there's no way to prove its authenticity to a third party without at least outing the company as the source.