I would take them to the cleaners Mrs O.
There is more than enough evidence to show that your son and his mate were on the bus (they have the time, the bus number, etc.). As many employees do, the woman hiding behind the Data Protection Act needs training in what it means, what it does and does not do (and it certainly does not prevent her discussing a matter such as this with you when it relates to your 14 year old child). (Having said that, many companies actively encourage their staff to mouth the words "Data Protection" as soon as any tricky questions are asked of them).
Get hold of the name and business address of the company's chief executive. Fire off a snotty to him and say that you want the matter fully investigated, you want your son's half-fare reimbursed and you want a bit of compo for your time and trouble.