The personal details of students at a fee-paying independent school have been shared online in a “serious breach” of data protection that could fall foul of the law.

The Information Commissioner’s Office is investigating after unique pupil numbers (UPN), full names, year groups and houses of 62 students at Harrodian School, which costs £5,669-a-term, were left in a spreadsheet uploaded to Google’s product forum.

The data was uploaded on November 20, 2013, by a user called “OurTom”, asking for help using Microsoft Excel pivot table filters, but was only reported last week.

The spreadsheet did not name the school, but a software developer who found the data was able to establish it was the school in Lonsdale Road, Barnes, based on the names of the houses.

Under the Data Protection Act 1998, a UPN is classed as “sensitive personal data” and can only be used by schools when required to provide information to the local authority, central government or a school the pupil was transferring to.

The 13-digit number is designated as a “general identifier”, making its use for any purpose unrelated to education illegal.

The software developer, who did not want to be named, said his find was a “serious breach” of data protection by the school and it was easy to confirm the data’s authenticity.

He said: “I spend a great deal of time considering information security and the implications of the Data Protection Act, so it is more than a bit frustrating when a school – exactly the sort of client that would stress the importance of such security to us – has such a poor awareness of their obligations.”

A statement from Edwards Duthie Solicitors, on behalf of Harrodian School, said: “The issues here come under the ambit of the Data Protection Act and are therefore being dealt with by our clients in accordance with the advice and guidance given by the Information Commissioner’s Office.

“Our clients, at all times, take very seriously their responsibilities as a data controller in respect of security and have taken all necessary steps to prevent any possible future breaches of the provisions of the Data Protection Act.

“As we are sure you will appreciate, as these are matters coming within the ambit of the Data Protection Act it would be inappropriate for us to enter into any further correspondence with you concerning them.”

The school did not wish to comment further.

The forum post and spreadsheet has since been deleted, but still appears on Google cache.

  • Does your child go to Harrodian School? Are you worried their details could have been shared online? Contact the newsdesk on 020 8722 6395 or email laura.proto@london.newsquest.co.uk.