I can't find the term 'substantial' in the linked source. So I think maybe you are editorialising.
Here is the actual text from 4.7.
> We have investigated the allegation that Cambridge Analytica provided
data analytics services to Leave.EU. Our focus has been on the use of
personal data and whether Leave.EU breached the DPA98. We served
Information Notices on Leave.EU and Cambridge Analytica to gather
evidence as part of our investigation.
> Information placed in the public domain by some of those subject to
investigation suggested a relationship between Cambridge Analytica and
Leave.EU, and both sides have acknowledged there was an initial
exploration of how to work together during the Referendum campaign.
Brittany Kaiser, Director of Program Development at Cambridge Analytica,
appeared at a Leave.EU news conference in 2015. Statements by
representatives of Leave.EU made in 2016 also indicated that Cambridge
Analytica had worked for them. Senior Cambridge Analytica staff also
claimed they worked with Leave.EU.
> In response to Information Notices served on them, both parties have
stated that only preliminary discussions took place, and the relationship
did not move forward when Leave.EU failed to attain the designation as
the official Leave campaign. In evidence provided to the ICO, Leave.EU
stated that four meetings took place:
> 23 October 2015 representatives of Leave EU met with CA
staff, this was a basic introductory meeting to express interest
in potentially working together
> 18 November 2015 CA appeared at a press conference with
Leave.eu
> 20 November 2015 CA went to Leave.EU’s Bristol offices and
pitched their product.
> 8 January 2016 representatives of Leave.EU met CA in
London, and CA presented a proposal for future work
together.
The ICO report does not specify that any work was carried out, or what exactly that work was.