A company that specialises in asking the public to take part in "surveys" in which the answers are then used to target respondents with unsolicited marketing calls has been fined.
An investigation found Verso Group had not been clear about what it was doing.
The Hertfordshire-based company came to regulators' attention after it was involved in one campaign that resulted in 46 million "nuisance calls" about payment protection insurance (PPI).
It has been ordered to pay £80,000.
The Information Commissioner's Office said it was the first such penalty following a wider investigation into the so-called data broking industry.
"This type of unlawful data directly fuels the nuisance call and spam text industry and creates misery for millions of UK citizens," said the ICO's deputy commissioner, James Dipple-Johnstone.
"Businesses need to understand they don't own personal data - people do."
Although the ICO has the power to issue fines of up to £500,000, the sum is still likely to be significant to Verso.
According to accounts filed in May, the Hertfordshire-based company's net assets totalled just £12,386.
A spokesman for Verso declined to comment.
Verso has been in business since 2011 and describes itself as the "largest lead-generation business in the UK by some distance".
According to its website, it uses call centres in India, the Philippines and North America to carry out surveys with the public, with the stated aim of helping consumers cut their utility bills.
These are branded as being carried out by the UK Savers Club and I Love My Offers among other names. Verso says it carries out more than 115,000 such surveys each month.
The business then offers other companies the ability to target consumers via email, phone, postal mail and text, based on the lifestyle, financial and demographic information gathered from respondents.
In addition to PPI insurance, Verso says its clients have used the information to sell loans, legal advice about accidents, extended warranties and beauty products.
Two of the companies Verso has sold data to - Pro Dial and Emacs - have previously been fined by the ICO over the way they had conducted their cold-call businesses.
A follow-up investigation into Verso concluded it was not providing survey respondents with specific enough information about to whom it planned to pass their data, and thus had failed to obtain the necessary consent to sell it on.
Moreover, the ICO said it had found Verso to be "unhelpful and obstructive" when it had tried to look into the matter.
"Verso's contraventions were systemic - they were not isolated, one-off or occasional errors," the report said, "[and] were of a kind likely to cause substantial damage or substantial distress."
The watchdog has ordered Verso to pay the fine by mid-November, although it could also try to appeal against the ruling.
Citizens' rights over their personal information are set to be strengthened next year under the UK's Data Protection Bill.
The law - which implements the EU's General Data Protection Regulation - makes it possible for a person to oblige a company to delete information held about them.
It also raises the cap on the size of penalties the ICO can demand.