The Brexit campaign group founded by businessman Arron Banks and an insurance company he owns have been fined a total of £120,000 for data protection breaches.
The Information Commissioner's Office (ICO) said Leave.EU and Eldon Insurance had been penalised for "serious breaches" of electronic marketing laws.
The two organisations were originally warned in November last year they would have to pay a total of £135,000, but one of the fines against Leave.EU was reduced by £15,000 following representations from the organisation.
It followed a finding by the ICO that the data of customers of Eldon Insurance - trading as Go Skippy - was unlawfully used by Leave.EU to send almost 300,000 political marketing messages, for which it was fined £15,000.
In addition, Leave.EU has been fined £45,000 and Eldon Insurance £60,000 in relation to the sending of more than one million emails to Leave.EU subscribers, including Go Skippy marketing material, without sufficient consent.
The Information Commissioner Elizabeth Denham said: "It is deeply concerning that sensitive personal data gathered for political purposes was later used for insurance purposes and vice versa. It should never have happened."
Leave.EU's head of communications Andy Wigmore said they were "disappointed but not surprised" at the announcement and would be appealing against the ruling through the courts.
"This is a politically motivated attack against our involvement in Brexit," he said.