The UK’s data watchdog has found that Leave.EU staff had access to the personal data of customers of Arron Banks’ insurance company, Eldon.
Leave.EU used the personal information of customers of an insurance company owned by Leave.EU founder Banks to unlawfully send them political marketing material.
The Information Commissioner’s Office is due to present the findings into the use of data by the EU referendum campaigns to Parliament on Tuesday morning.
The ICO notified Leave.EU and Bank’s Eldon Insurance on Monday that they are facing fines totalling £135,000 for data protection breaches, according to leaked parts of the report seen by BuzzFeed News.
The report states: "We have concerns about the overall management of the data within the company [Eldon], particularly about the arrangements for sharing personal data handled by the company and its associates.
"We have evidence to show that customers' personal data, in the form of email addresses, held by Eldon was accessed by staff working for Leave.EU and was used to unlawfully send political marketing messages."
In September 2015, more than 319,000 Eldon customers received a Leave.EU email newsletter.
Leave.EU told the ICO that this was the result of an error in the email distribution system and claimed that it had reported the error.
However, the report adds: "[W]e have no record of any such incident being reported to us and have asked the company for details to confirm this."
Leave.EU face a £15,000 fine for sending the email newsletter because it “did not have the consent of the subscribers”.
'They did not have consent'
Watch: Krishnan Guru-Murthy talk about Arron Banks refusing to be interviewed by Channel 4.
The ICO also found that Leave.EU sent emails to its own subscribers promoting Eldon, which trades as GoSkippy.
"During two separate campaigns, Leave.EU sent emails to their subscribers which contained marketing information, promoting GoSkippy and its insurance products, for which they did not have consent," the report says.
The ICO says it intends to fine Leave.EU and Eldon £60,000 each for these data breaches.
Last week, Banks was referred to the National Crime Agency by the Electoral Commission.
The Electoral Commission said it had “reasonable grounds” to suspect that Banks was not the “true source” of the £8 million he donated to the pro-Brexit campaign.