Hundreds of thousands of campaign emails promoting the Leave.EU Brexit campaign were sent to customers of a company owned by Arron Banks, in a serious breach of data law.
The Information Commissioner's Office [ICO] found that the political campaign used access to the personal data of customers of Eldon Insurance to unlawfully send them political marketing material.
It included the sending of nearly 330,000 emails to customers of Eldon Insurance - trading as GoSkippy - containing a Leave.EU newsletter, for which the campaign group faces a £15,000 fine.
The report added: "We are investigating allegations that Eldon Insurance Services Limited shared customer data obtained for insurance purposes with Leave.EU".
Banks played down the announcement.
But it did not conclude that data harvesting techniques had been a decisive factor in the Brexit vote, stating that "it is impossible for us to say whether the data techniques used by either side in the UK EU referendum campaign impacted on the result".
Hitting back on Twitter, Banks appeared to dismiss the seriousness of the claims, writing: "Gosh we communicated with our supporters and offered then a 10% Brexit discount after the vote!"
Senior EU officials extolled the successes of the bloc's data protection regulations on Thursday (25 October), as Facebook was fined £500,000 for its part in the Cambridge Analytica scandal.
Since then, Banks has faced questions about his tactics and finances in the referendum.
"We found no evidence that Big Data Dolphins ever actually functioned, and no evidence that Leave.EU, Eldon or any associated companies had transferred any personal data relating to United Kingdom citizens to the UoM".
Both Denham and her office's report indicated that the United Kingdom was at a cross-roads in terms of the use of data in political campaigning but warned that tighter regulation of tech firms was "quite controversial and the need to balance freedom of expression with the harms of the internet is hard", she told MPs.
Giving evidence to the parliamentary inquiry into disinformation and fake news on Tuesday, Denham voiced "concerns about ongoing misuse of personal data" at Leave.EU and Eldon Insurance.
"We may never know whether individuals were unknowingly influenced to vote a certain way in either the UK EU referendum or in the USA election campaigns", she said.