Whlist the threat of a large fine is always present, it would be unlikely to see ICO issue a large fine to any school unless there has been a catastrophic breakdown of security of personal data. Saying that there are instances of such events.