The Information Commissioner's Office (ICO) has fined Leave.EU and Arron Banks a combined sum of 120,000, following investigations into the companies' marketing practices.
The regulator issued three notices of intent and a preliminary enforcement notice after it came to light that the two organisations were not complying with the General Data Protection Regulations (GDPR).
It also announced an audit of the companies jointly trading under the name of Go Skippy Insurance, will be fully audited by the ICO to inspect current data protection practices, while Eldon Insurance has also received an enforcement notice specifying it must take steps to comply with electronic marketing regulations, specifically the use of data analytics for political purposes.
The ICO said Leave.EU and Eldon Insurance were linked and had not sufficiently separated the data from insurance customers and Vote Leave supporters, meaning Eldon Insurance customers were sent political campaigns completely unrelated to the reasons they had opted in to receiving marketing communications.
The ICO's investigation found that 300,000 insurance customers were sent emails about Leave.EU's political campaign, resulting in a 15,000 fine for the firm.
However, it was a further two marketing campaigns that resulted in the biggest penalties.
The finance firm used Leave.EU's data to send more than a million emails about insurance, across two digital marketing campaigns, without consent. For this breach of trust, Leave.EU was fined a further 45,000, while Eldon was lumped with a 60,000 penalty.
"It is deeply concerning that sensitive personal data gathered for political purposes was later used for insurance purposes; and vice versa. It should never have happened," Elizabeth Denham, Information Commissioner said.
"We have been told both organisations have made improvements and learned from these events. But the ICO will now audit the organisations to determine how they are using customers' personal information."
Get the ITPro. daily newsletter
Receive our latest news, industry updates, featured resources and more. Sign up today to receive our FREE report on AI cyber crime & security - newly updated for 2023.
Clare is the founder of Blue Cactus Digital, a digital marketing company that helps ethical and sustainability-focused businesses grow their customer base.
Prior to becoming a marketer, Clare was a journalist, working at a range of mobile device-focused outlets including Know Your Mobile before moving into freelance life.
As a freelance writer, she drew on her expertise in mobility to write features and guides for ITPro, as well as regularly writing news stories on a wide range of topics.