Staff at mobile phone company T-Mobile passed on millions of records from thousands of customers, a spokesman for the firm has confirmed.
The suspected illegal trade emerged after the firm alerted the Information Commissioner.
He said brokers bought the data and sold it on to other phone firms, who then cold-called the customers, as their contracts were due to expire.
A T-Mobile spokesman said the data was sold "without our knowledge".
Mr Graham, who was appointed earlier this year as the watchdog responsible for safeguarding personal information, said the case illustrated why there needed to be a prison sentence to prevent people from selling private data to third parties.
He confirmed his office was preparing a prosecution against those responsible for selling on T-Mobile data.
Justice Minister Michael Wills told the BBC that there was a "strong case" for introducing custodial sentences to prevent the trade in illegal data.
Earlier, Mr Graham had said he would not name the operator involved as it could prejudice a prosecution.
But after phone firms 02, Vodafone, Orange, 3 and Virgin said they were not the subject of the investigation, T-Mobile confirmed it had been.