A million Britons responded to a secretive Facebook campaign for a hard Brexit overseen by Lynton Crosby’s company, according to the information commissioner, who said the respondents’ email addresses may have been harvested for future use.

Elizabeth Denham told MPs her investigation into the Mainstream Network campaign group had raised concerns about how valuable voter data was being collected by the under-the-radar campaign, potentially in breach of data protection rules.

Mainstream Network was designed to look like a grassroots campaign and give the impression that the British public was rising up in support of a no-deal exit from the European Union, by encouraging the public to flood MPs’ inboxes with emails demanding one.

However, the Guardian has revealed that the supposedly independent pro-Brexit Facebook pages were part of a series overseen by Crosby’s company, CTF Partners. They were backed by up to £1m in online advertising, paid for by an unknown source in a bid to push MPs to reject Theresa May’s Brexit deal.

“Part of our investigation is looking at individuals associated with that campaign and their relationship with others,” Denham told MPs, as she gave an update on her investigation. “It’s all part of following through on what is quite a complex investigation.”

Facebook Twitter Pinterest The UK information commissioner, Elizabeth Denham. Photograph: Christopher Thomond/The Observer

Denham’s office obtained information from Facebook on Mainstream Network as part of a wider investigation into the use of political data in the wake of the Cambridge Analytica scandal. The information commissioner revealed that a million people clicked on Facebook adverts paid for by Mainstream Network, with an unknown number going on to email their MP to urge them to reject the prime minister’s plans for a Brexit deal.

The Mainstream Network was automatically copied in on all of these emails, creating a valuable list of British voters who are passionately interested in Brexit – a potentially valuable data resource for a pro-Brexit political party or politician.

“Clicking on the ad would create an email that … would allow the harvesting of email addresses, and perhaps other personal information to be collected by that third party, which could lead to more sophisticated microtargeting in the future,” warned Denham.

MPs also heard that the pro-Brexit campaigns have been running since 2017, apparently confirming suggestions that they were part of a long-running secretive campaign by Crosby’s company to undermine Theresa May’s position and push Britain towards a hard Brexit.

Millions more voters are likely to have clicked on similar campaigns run by pro-Brexit groups linked to Crosby, such as Britain’s Future and We Are The 52%, as part of what appears to be the biggest online political advertising campaign run outside an election period in Britain.

Denham agreed that Facebook’s new political advertising transparency tools could be misleading because they allowed campaigns to appoint a single frontman as the public face of an organisation, without real clarity on who is actually running the campaign.

She said it was an issue that required government involvement: “You can’t leave it to an individual company to put in place what needs to be more robust, effective transparency tools.”

The commissioner was speaking at the first meeting of the new House of Commons subcommittee on online disinformation, which was set up by the digital, culture, media and sport committee following its long-running investigation into fake news and the manipulation of politics through technology.

She said she was also “surprised and disappointed” by the lack of space given to the regulation of online political campaigns in the government’s recent Online Harms white paper, saying there should be more focus on what she called a “huge societal harm”.

“The campaigning period runs 365 days a year and there are new ways for data to be harvested – there’s a lack of understanding of how social media audiences work,” she said, warning that the government did not have enough resources to pass new laws to secure future elections because of Brexit.

“It’s challenging because there’s not enough legislative time to make some of the improvements that would protect our democratic institutions and processes,” she said.

CTF Partners has been approached for comment.