A watchdog has found the retail giant interfered with the privacy of hundreds of thousands of customers in a landmark case.