Party must show how it spent £300,000 on data services in run-up to 2016 vote and 2015 election

Ukip has been ordered to fully reveal details of how it used nearly £300,000 of political data services in the run-up to the Brexit vote and the 2015 general election after the party lost a two-year legal battle to block disclosure.

An appeals tribunal found the political party, led at the time by Nigel Farage, failed to properly answer the information commissioner’s questions. It is now legally obliged to provide detailed answers to questions about how it spent political donations and used polling companies and data.

The ruling is the latest watchdog finding to cast a shadow over the 2016 EU referendum and to raise concerns about the use of political and social media data.

Last year the Electoral Commission found both the official Vote Leave campaign – in which Boris Johnson and Michael Gove played key roles – and the unofficial Leave.EU campaign guilty of breaking electoral law. The commission fined both campaigns and referred its findings to the police.

Facebook also came in for criticism from the information commissioner and was fined £500,000 in the wake of the Cambridge Analytica scandal for allowing third party developers to access user information without sufficient consent. The latest ruling is a result of a separate Information Commissioner’s Office (ICO) investigation into how political parties use data analytics to target voters. It was launched in response to public concern about the use of social media during the referendum, after the Observer’s initial investigation into the abuse of data and the work of Cambridge Analytica.

When the investigation opened in 2017, the information commissioner, Elizabeth Denham, said more than 30 organisations were under scrutiny. While some were cooperating, she said, “others are making it difficult.”

In the latest ruling, Judge Nicholas Wikeley criticised Ukip’s failure to cooperate with the ICO, saying: “Its answers arrived late and were brief and unsatisfactory, not least in being inconsistent with publicly available information previously supplied by Ukip itself. Overall, Ukip’s response gave the commissioner the clear impression that the party was not taking the request seriously.”

Facebook Twitter Pinterest Arron Banks (right) talks to an anti-Brexit campaigner outside the Houses of Parliament. Photograph: Leon Neal/Getty Images

When the commissioner first wrote to Ukip, the party replied: “It turns out we hardly use data at all.”

It specifically denied using the services of Constituency Polling Ltd, which is linked to polling firm Survation, even though the Electoral Commission’s register showed that Ukip spent £186,613.13 with the company during the 2015 general election.

Ukip also spent a small sum – £72.00 – on the unofficial Leave.EU campaign during the referendum, and directed much larger sums to companies whose owner Arron Banks was a major Ukip donor and founder of Leave.EU. “Better for the Country”, which was used to finance Leave.EU, received £67,236 during the EU referendum and Rock Services Limited was paid £64,762.73 during the 2015 general election.

The National Crime Agency is investigating allegations of multiple criminal offences by Arron Banks and Leave.EU in the Brexit referendum. One focus of the investigations is £2m reported to have been lent to Better for the Country.

Banks and Elizabeth Bilney, who chaired the Leave.EU campaign, said they rejected any allegations of wrongdoing, and argued the investigation was motivated by political considerations.

Leave.EU and another Arron Banks firm, Eldon Insurance, were also fined over data law breaches in the referendum.

Ukip also later admitted in further correspondence to the data commissioner: “In the past we have used targeted ad [sic] on Facebook during the referendum and we have used the boost service for our ads. We have not granulated data any further than that.”

The commissioner has found that many political parties bought marketing lists and lifestyle information from data brokers “without sufficient due diligence” as to their activities. They also used third-party data analytics companies without checking if users had given consent for their personal information to be passed on and used for political purposes.

Ukip was specifically asked about its links to another organisation called NationBuilder, an online campaigning platform which the ICO said was used by up to 200 political parties or campaign groups during the 2017 general election. NationBuilder has a “match function” allowing parties to match their own databases with social media data from public profiles, which the regulator said could be happening without the people affected knowing. NationBuilder said the match function was optional and could be switched off by its clients.

In its appeal, Ukip argued the information commissioner did not have the power to make such demands on it. It also said it was “a relatively small, modestly funded organisation with largely part-time staff. Ukip does not have great resources and does the best it can with what it has.”

Ukip said: “This case concerned an information notice served on Ukip, which was unclear in its scope. As there were no existing legal authorities on how information notices should be interpreted, Ukip chose to appeal it. This judgment is the final determination in that matter and Ukip has since supplied the information required of it to the ICO.”