The Essex secondary broke the law when it ‘failed’ to take appropriate data protection safeguards, the Information Commissioner’s Office said.