The Information Commissioner's Office says schools face an "insider threat" from children as young as seven.