The Brexit campaign group founded by businessman Arron Banks and an insurance company he owns have been warned they face fines totalling £135,000 for data protection breaches.

The Information Commissioner’s Office (ICO) said it had issued “notices of intent” to Leave.EU and Eldon Insurance for “serious breaches” of Privacy and Electronic Communications Regulations.

It followed the discovery of evidence that some Eldon customers’ personal data had been used by Leave.EU to unlawfully distribute political marketing messages, the ICO said.

It included the sending of almost 330,000 emails to customers of Eldon Insurance – trading as GoSkippy – containing a Leave.EU newsletter, for which the campaign group faces a £15,000 fine.

Arron Banks
Arron Banks is being investigated by the National Crime Agency (Victoria Jones/PA)

The ICO also warned that Leave.EU and the insurance company face fines of £60,000 each in relation to the sending of more than 1 million emails to Leave.EU subscribers which included GoSkippy marketing material.

The details were released as the Information Commissioner, Elizabeth Denham, was presenting the ICO’s findings to MPs at a hearing of the Commons Digital, Culture, Media and Sport Committee.

In its final report on the use of data analytics in political campaigning, the ICO also disclosed that it would have issued Cambridge Analytica – the company at the centre of the Facebook data breach – with a “substantial fine” if it had not gone into administration.

Leave.EU hit out at the ICO accusing it of acting “in collusion” with the committee and its chairman Damian Collins to discredit Brexit.

Eldon Insurance said that it had only received the “notice of intent” from the ICO at 4pm on Monday and would be making representations concerning its findings.

In its report the ICO said: “We have concerns about the overall management of personal data within the company particularly about the arrangements for sharing personal data handled by the company and its associated entities.

“We have evidence to show that some customers’ personal data, in the form of email addresses, held by Eldon was accessed by staff working for Leave.EU and was used to unlawfully send political marketing messages.”

The finding comes after it was announced that the National Crime Agency had opened investigation into Mr Banks for “suspected criminal offences” over £8 million in campaign funding during the referendum.

Leave.EU spokesman Andy Wigmore said: We are surprised as yet again it seems the ICO has also clearly been in collusion with Damian Collins and his committee to showboat an accusation and fine that we were only told about  last night.

“Clearly due process is lost on these regulators – it’s just another attempt by Collins and his corrupt, biased fake news committee to attack Arron Banks and Brexit.

“We will be requesting all correspondence under FOI (Freedom of Information) from Collins to see what collusion (there was) between his committee and the ICO.

“We note it’s just a notice of intent and we had the right to reply which had now effectively been sabotaged by Collins and the collusion of the ICO – clearly to discredit us and Brexit.”

Eldon said in a statement: “It should be noted that the ICO makes it clear in the notice of intent that they do not consider Eldon to have deliberately committed any contravention of the relevant regulations.

“The notice of intent is not a final notice and we will be exercising our right to make representations to the ICO in relation to the content of and the decisions that the ICO intend to make in the notice of intent.”