A cautionary tale can be found on the ICO's website:
https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/09/ex-council-worker-fined-for-stealing-vulnerable-people-s-personal-information/
It serves as a reminder to all those working in education and social care that data belongs to the organisation and is not the property of an individual even if they created the data set!