Several allegations of unlawful campaigning in the 2016 EU referendum have been made. Some allegations were dismissed by the investigating bodies, but in other cases wrongdoing was established, leading to the imposition of penalties. Sanctions have included the levying of the maximum fine possible upon Facebook for breaches of data privacy.

Several institutions have investigated the allegations: the Information Commissioner's Office (regarding the handling of personal data); the Electoral Commission (regarding penalising breaches of electoral law); the National Crime Agency; the Metropolitan Police, and Crown Prosecution Service (regarding criminal prosecution); the UK Parliament; the European Parliament; and the Venice Commission; there have also been private prosecutions.

Information Commissioner's Office (2017-present)

On 4 March 2017, the Information Commissioner's Office (ICO) reported that it was 'conducting a wide assessment of the data-protection risks arising from the use of data analytics, including for political purposes' in relation to the Brexit campaign.Jamie Doward, Carole Cadwalladr and Alice Gibbs, 'Watchdog to launch inquiry into misuse of data in politics', The Observer (4 March 2017).Carole Cadwalladr, 'The great British Brexit robbery: how our democracy was hijacked', The Observer (Sunday 7 May 2017). In May 2017, the ICO also launched an investigation into the use of data analytics for political purposes, making reference to both the EU referendum and the 2015 general election.Elizabeth Denham, 'The Information Commissioner opens a formal investigation into the use of data analytics for political purposes', Information Commissioner's Blog (17 May 2017).Sunny Hundal, 'Investigation launched into the 'secret world' of how millionaires used Facebook and other data to push Brexit', OpenDemocracy (17 May 2017).Robert Verkaik and Emma Graham-Harrison, 'Judge orders Ukip to reveal Brexit referendum data use ', The Observer (14 April 2019). In March 2018 The Economist published an article stating that breaches of electoral law were unlikely to have had a substantive effect on the outcome of the EU Referendum: "Does any of this matter beyond Westminster? If Vote Leave is found to have breached the rules, that will support the notion that Leavers played fast and loose in 2016. Yet Remainers spent a lot more, and benefited from a government leaflet costing £9m that openly backed their cause. On the evidence so far, it is hard to conclude that the 52:48 result was changed by digital marketing, however cleverly done."'Did Vote Leave cheat to win the Brexit referendum?', The Economist (27 March 2018).

In July 2018, the Information Commissioner's Office main report was published and showed it was investigating a number of bodies for unlawful use of data during the EU Referendum—particularly the unlawful passing of data from one organisation to another.Information Commissioner's Office, 'Investigation into the use of data analytics in political campaigns: Investigation update ' (11 July 2018). The investigation was at that point ongoing due to an appeal by UKIP, which was rejected in February 2019.Information Commissioner's Office, 'Democracy disrupted? Personal information and political influence' (11 July 2018).Judge Wikeley, 'The Upper Tribunal (Administrative Appeals Chamber) Upper Tribunal Case No. GIA/2069/2018; Parties: United Kingdom Independence Party Ltd (Appellant) and The Information Commissioner (First Respondent)' (18 February 2019). In April 2019, the investigation was in this respect ongoing. In November 2019 it was reported that the ICO would next report is spring 2020 or later.James Cusick, 'New evidence that LibDems sold voter data for £100,000 held back till after election', OpenDemocracy (13 November 2019).

The investigations included: The acquisition and deployment of Facebook data by Cambridge Analytica and Global Science Research. The relationship between AggregateIQ, SCL Elections Ltd and Cambridge Analytica. Cambridge University and the Cambridge University Psychometric Centre. Links between Leave.EU and Cambridge Analytica. The relationship between Leave.EU and Eldon Insurance (along with the passing of data to Big Data Dolphins and the University of Mississippi). The relationship between Vote Leave, AggregateIQ, and other Leave campaigns. Vote Leave's handling of personal data. The official Remain campaign's use of personal data, including data which was sold to it by the Liberal Democrats.

The sections below report penalties and enforcement notices that have been issued.

Vote Leave On 19 March 2019, Vote Leave was fined £40,000 for sending 196,154 unsolicited electronic messages to people who had not given consent for their contact details to be used for these purposes.'DATA PROTECTION ACT 1998 SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER MONETARY PENALTY NOTICE (19 March 2019).'Vote Leave fined over thousands of unsolicited texts', BBC News (19 March 2019).

Leave.EU The Information Commissioner's Office has found Leave.EU guilty of breaking the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the Data Protection Act 1998 on a number of counts. This included using contacts gathered by Eldon Insurance for their own direct marketing purposes, and, vice versa, enabling the insurance company to use their contacts for its direct marketing. +DateCompanyCausePenaltySources9 May 2016Better for the Country, a.k.a. Leave.EUSending people text messages without having first gained their permission to do so.£50,000'EU campaign firm fined for sending spam texts ' (11 May 2016).Information Commissioner's Office, 'Information Rights Report' (quarter 1, 2016/17), p. 30.1 February 2019Leave.EU296,522 direct marketing emails delivered without subscribers' consent.£15,000Information Commissioner's Office, 'Data Protection Act 1998: Supervisory Powers of the Information Commissioner monetary Penalty Notice' (1 February 2019).1 February 2019Leave.EU1,069,852 Eldon Insurance direct marketing emails to 54,000 subscribers without consent.£45,000Information Commissioner's Office, 'Data Protection Act 1998: Supervisory Powers of the Information Commissioner Monetary Penalty Notice' (1 February 2019).1 February 2019Eldon Insurance Services Limited (trading as GoSkippy Insurance)1,069,852 Eldon Insurance direct marketing emails to 54,000 subscribers without consent.£60,000 + enforcement noticeInformation Commissioner's Office, 'Data Protection Act 1998: Supervisory Powers of the Information Commissioner Monetary Penalty Notice' (1 February 2019).Information Commissioner's Office, 'Data Protection Act 1998: Supervisory Powers of the Information Commissioner Enforcement Notice' (1 February 2019).

AggregateIQ On 24 October 2018, the Information Commissioner's Office served a legal notice requiring AggregateIQ Data Services Ltd to 'erase any personal data of individuals in the UK'.Information Commissioner's Office, 'Enforcement Notice: The Data Protection Act 2018, Part 6, Section 149' (24 October 2018).

Facebook On 24 October 2018, the Office found that between 2007 and 2014, Facebook had broken the UK data law then in force, the Data Protection Act 1998, and applied £500,000, the highest penalty allowed under that Act, noting that under more recent legislation, the General Data Protection Regulation the fine would have been much higher. Facebook allowed application developers to access people's data "without sufficiently clear and informed consent" and failed to keep their personal information secure, which allowed Aleksandr Kogan and his company Global Science Research to harvest the data of as many as 87 million people worldwide (including at least one million in the UK) to share a subset of this data further, including with SCL Group, the parent company of Cambridge Analytica. Facebook also did not act firmly enough to ensure that, once known, these data breaches were remedied.Information Commissioner's Office, 'ICO issues maximum £500,000 fine to Facebook for failing to protect users’ personal information' (25 October 2018).Information Commissioner's Office, 'Data Protection Act 1998: Supervisory Powers of the Information Commissioner, Monetary Penalty Notice' (24 October 2018). In July 2019, it was reported that Facebook would be fined around $5bn by the US Federal Trade Commission in relation to the same and related issues.Julia Carrie Wong, 'Facebook to be fined $5bn for Cambridge Analytica privacy violations – reports', The Guardian (12 July 2019).

Electoral Commission (2017-2018)

Spending returns In February 2017, the Electoral Commission announced that it was investigating the spending of Britain Stronger in Europe and Vote Leave, and smaller organisations, as they had not submitted all the necessary invoices, receipts, or details to back up their accounts.[Election watchdog probes spending by EU referendum campaign groups], The Daily Telegraph (24 February 2017).

In the ensuing months, it levied a number of fines on political parties and other campaign entities for breaching campaign finance rules during the referendum campaign, with £20,000 as the maximum possible fine under the law .Maidment, Jack (19 December 2017) "Liberal Democrats fined £18,000 for breaching campaign finance rules relating to EU referendum". The Daily Telegraph. Fines of £1000 or more were: +DateOrganisationCausePenaltySources16 August 2017Constitutional Research CouncilFailure to notify the Electoral Commission of political contributions it made (including £435,000 to the Democratic Unionist Party (DUP)), and gifts it received.£6,000Niall McCracken, 'Questions surround £6,000 fine linked to Northern Ireland political donation', thedetail (16 August 2017).Niall McCracken, 'CRC Brexit donation to DUP not reported to watchdog', BBC News (19 December 2018).19 December 2017Liberal Democrat PartyFailure to deliver a complete and accurate spending return.£18,000Electoral Commission, 'Liberal Democrats fined £18,000 for breaches of campaign finance rules' (19 December 2019).19 December 2017Open Britain (formerly Britain Stronger in Europe)Failure to deliver a complete and accurate spending return.£1,25011 May 2018Leave.EUFailure to deliver complete and accurate pre-poll transaction report and post-poll spending information (responsible person: Elizabeth Bilney).£50,000Electoral Commission, 'Report on an investigation in respect of the Leave.EU Group Limited Concerning pre-poll transaction reports and the campaign spending return for the 2016 referendum on the UK’s membership of the European Union' (11 May 2018).15 May 2018Best for Our Future LimitedFailure to deliver a complete and accurate spending return.£2,000Electoral Commission, 'Campaigners and political parties fined for breaching political finance rules' (15 May 2018).15 May 2018UnisonFailure to deliver a complete and accurate spending return and late payment of an invoice.£1,50017 July 2018Vote LeaveFailure to deliver a complete and accurate spending return (responsible person: David Alan Halsall); failure to provide documents on time.£41,000Electoral Commission, 'Report of an investigation in respect of: Vote Leave Limited, Mr Darren Grimes, BeLeave, Veterans for Britain ' (17 July 2018).

Funding sources

Constitutional Research Council