The Canadian data firm AggregateIQ (AIQ) broke privacy laws with some of the work it did for a leading pro-Brexit group in Britain and a number of US political campaigns, according to a watchdog’s official report.

Canada’s federal privacy commissioner, Daniel Therrien, along with his counterpart in the province of British Columbia, said on Tuesday that AIQ had not taken measures to ensure it had the authority to disclose UK voter information.

“Canadian organizations operating globally... must ensure they understand and comply with their legal responsibilities in Canada, even when they are operating in foreign jurisdictions,” McEvoy told a news conference.

AIQ was hired in 2016 by Vote Leave, which campaigned for Britain to leave the European Union, to draw up Facebook advertisements aimed at potential voters. AIQ, based in British Columbia, used data gathered online by Vote Leave, which it disclosed to Facebook.

The privacy commissioners found Vote Leave had not explained to respondents that their information might be shared with Facebook, and AIQ did not do enough to make sure it had the right to use the information.

The watchdog’s report said: “When the company used and disclosed the personal information of Vote Leave supporters to Facebook ... it went beyond the purposes for which Vote Leave had consent to use that information.”

It added: “When AIQ failed to ensure it had meaningful consent from the individuals whose personal information it collected, used, or disclosed, it contravened British Columbia and Canadian privacy laws.”

AIQ Chief Operating Officer Jeff Silvester said in an email that the firm had already implemented all of the commissioners’ recommendations.

The report expressed similar concerns about lack of consent regarding some of the work AIQ had done on campaigns in the US for Strategic Communication Laboratories, the former name of the SCL Group, the parent company of the political consultancy Cambridge Analytica.

Facebook came under pressure last year after revealing that the personal information of up to 87 million users, mostly in the US, may have been improperly shared with Cambridge Analytica.

In April, Therrien concluded in a separate investigation that Facebook committed serious contraventions of Canadian privacy law and failed to take responsibility for protecting the personal information of citizens.