attachment containing the sensitive personal information had been sent to 20 students and 37 guardians, in addition to which the sender had also sent a copy to himself