The group, co-founded by Banks, did not have the consent of subscribers for more than 296,500 unsolicited marketing emails it sent, the investigation found.
Similarly, more than 1 million emails including GoSkippy marketing material were sent to Leave.EU suscribers.
Leave.EU faces a £15,000 fine after nearly 330,000 customers of Eldon, which trades as GoSkippy, were sent an email containing a Leave.EU newsletter, according to the ICO.
Caption: FILE PHOTO: Gerry Gunster (L), a Washington-based strategist hired by the Leave.EU campaign, speaks as he sits with Arron Banks, a British businessman, during a Leave.EU news conference in central London, Britain November 18, 2015.
Meanwhile, a single email announcing a sponsorship deal with GoSkippy was sent to 49,000 email addresses in August 2016. He added: 'Gosh we communicated with our supporters and offered them a 10 per cent Brexit discount after the vote!
It followed the discovery of evidence that some Eldon customers' personal data had been used by Leave.EU to unlawfully distribute political marketing messages, the ICO said.
It said it was also investigating allegations that Eldon shared customer data obtained for insurance purposes with Leave.EU.
"We need to look at whether the processes are working to be able to separate the data from political campaigning and from insurance use", she said.
"But we do know that personal privacy rights have been compromised by a number of players and that the digital electoral ecosystem needs reform".
A final decision is still to be reached on an alleged breach relating to the company's overall handling of personal data.
Both Denham and her office's report indicated that the United Kingdom was at a cross-roads in terms of the use of data in political campaigning but warned that tighter regulation of tech firms was "quite controversial and the need to balance freedom of expression with the harms of the internet is hard", she told MPs.
"Our investigation uncovered significant issues, negligence and contraventions of the law", she continued.
"What can we do to ensure that we preserve the integrity of elections and campaigns in future, in order to make sure that voters are truly in control of the outcome? Whilst voluntary initiatives by the social media platforms are welcome, a self-regulatory approach will not guarantee consistency, rigour or public confidence".