Our junior school asked pupils to write their name, dob and home address on a story competition entry then send it off to a private company. Is this a breach of confidentiality or data protection act?