An ICO investigation found The Data Supply Company had sold more than 580,000 records containing people’s details. This resulted in 21,000 spam texts being sent by the firm who bought the information.