Information watchdog says party’s data controller should consider ‘taking further action’ over unauthorised portal