The millions of people whose data it is selling on must now be informed, says the UK watchdog.