The Conservatives have been fined £10,000 by the data watchdog for sending marketing emails to 51 people who did not want to receive them.
The messages were sent in the name of Boris Johnson in the eight days after he became prime minister in July 2019.
The party was also criticised by the Information Commissioner for a mailshot in December 2019 after concerns had been raised.
The Conservatives said they accepted the fine and had improved processes.
It is against the law to send direct marketing emails, unless the recipient has given their consent.
The Information Commissioner’s Office (ICO) said it would continue to take action against “nuisance marketing emails”.
Between 24 July and 31 July 2019, the Conservatives sent out more than a million marketing emails.
The ICO said some of the emails were “validly sent” but the party did not have the necessary consent from 51 of the recipients.
The watchdog said the problem resulted from the Conservatives’ failure to transfer records of who had unsubscribed from its marketing emails when the party switched its email provider.
Later that year, during the 2019 December general election, the Conservatives also sent out nearly 23 million emails – something the ICO says resulted in a further 95 complaints.
The watchdog expressed concern that the party had conducted the “industrial-scale marketing email exercise” while the ICO’s investigation was still ongoing.
Stephen Eckersley – director of investigations at the ICO – said: “It’s really concerning that such large scale processing occurred during the ICO’s ongoing investigation and before the Conservative Party had taken all the steps necessary to ensure that its processing, and database of people who would receive emails, was fully compliant with the data protection and electronic marketing regulations.
“Getting messages to potential voters is important in a healthy democracy but political parties must follow the law when doing so.
“The Conservative Party ought to have known this, but failed to comply with the law.”
The Information Commissioner’s Office also said its investigation had taken a long time because “the party repeatedly failed to provide responses within time periods set, even when those periods were extended”.
“The commissioner does not consider that this was satisfactory compliance with reasonable requests from the statutory regulator,” it said.
A Conservative Party spokesman said it accepted the fine and had since “reviewed and improved our processes and are fully compliant with all prevailing data protection and electronic marketing legislation”.