Department for Education flouted rules when it secretly shared pupil data with Home Office, says watchdog