A Canadian analytics firm that worked for Vote Leave has received the UK's first formal notice under a key data law, the UK's data protection watchdog has confirmed.
AggregateIQ (AIQ) was accused of processing people's data "for purposes which they would not have expected".
Issued by the Information Commissioner's Office (ICO), the notice gives AIQ 30 days to "audit, assess, implement and document" its data processing practises or face the maximum GDPR fine of £17m, or four per cent of its annual global turnover.
The firm has appealed against the notice,
AIQ is a small Canadian data firm that uses data to target online ads at voters during public polls.
It was paid nearly £2.7m ($3.6m) by Vote Leave to target ads at prospective voters during the Brexit referendum campaign.
It was also used by pro-Brexit youth group BeLeave.
Vote Leave has been fined £61,000 and referred to the police after an Electoral Commission probe said it broke electoral law by exceeding its spending limit by funnelling money through BeLeave.
AIQ also received funding from Northern Ireland's Democratic Unionist Party and Veterans for Britain, amounting to a total of £3.5m from all of its pro-Brexit clients.
