Schools across the country are unwittingly selling CCTV images of pupils that could end up in the wrong hands and be published on the internet, The TES can reveal.
Figures from Camera Watch, a not-for-profit CCTV advisory body, also show that nine out of 10 schools are breaking the law by not following guidance when fitting and using CCTV cameras.
A leading technology expert told The TES that when a school upgrades its camera system and sells its old equipment, it is usually unaware that captured images are stored on a hard drive.
Brian Larkins, director of Video Management Services and a CCTV specialist, said anyone could pick up a hard drive containing thousands of images of schoolchildren.
"There is little or no control of images held on redundant recording equipment," he said. "We ran a test and bought a second-hand digital recorder on eBay and were not surprised to find it full of images of young children. It is particularly disturbing to find images of young people when schools have both a legal and moral duty to keep them in a secure manner."
Mr Larkins added: "A technician or a school will sell the equipment without realising there is sensitive information on there. It is the same when people sell laptops without wiping their hard drives."
Camera Watch says the issue is just one example of a much broader problem with the use of security cameras across the UK.
Paul Mackie, its compliance director, said thousands of schools were leaving themselves open to legal action by not abiding by the Data Protection Act in its care of data stored in cameras.
Mr Mackie said: "It is a huge problem and it doesn't matter whether it is an old school or a brand spanking new one: every one I have visited is not compliant with data protection legislation under European human rights law (on which the Data Protection Act is based).
"The images should be treated the same as a doctor would treat his patients' files. They are to be kept confidentially."
He said schools were flouting the law in a number of ways, including not storing their data correctly and placing CCTV cameras in the pupils' toilets.
Mr Mackie said if schools do not comply with the guidance, it means any evidence collected by their CCTV equipment might later be thrown out of court.
"If there was a particular case of bullying or a violent act took place in a school that was caught on camera and was taken to a court of law, unless the CCTV use was compliant with the EU guidance, then that evidence could be dismissed," he said.
A spokesperson for the Department for Children, Schools and Families said: "Schools should be abiding by the Data Protection Act and the Government's regulations on safe disposal of CCTV cameras. The Information Commissioner's Office has a code of practice on CCTV cameras which (government technology agency) Becta advises schools to follow."