Most of Britain's major High Street banks are among 13 financial and other institutions that have had to sign undertakings to take better care of their rubbish.

A crackdown by the Information Commissioner's Office (ICO) followed a series of incidents where organisations, among them the Post Office and the Immigration Advisory Service, broke data protection rules by dumping customers' personal details in outdoor bins.

In a report published yesterday, the ICO found all 13 in breach of the Data Protection Act. ICO deputy commissioner David Smith said they "carelessly" threw away customer information. The National Consumer Council (NCC) said customers had been put at risk of ID theft.

Ordering them to sign a formal undertaking to comply with the Data Protection Act in future, the privacy watchdog said failure to do so would result in further enforcement action - possibly prosecution.

Scotland's big three banks, the Royal Bank of Scotland, Clydesdale and HBOS, were on the list - although only two Scottish branches were involved. At a Glasgow branch of the Royal, a private banking form, computerised printout and a pre-release funds check-list were found in bin outside.

At the Clydesdale's Giffnock branch, items found in bins included a telephone banking form containing a customer's name and contact details, six cash deposit bags showing customers' names and account numbers as well as 22 computerised printouts showing direct debits and bank giro credits to customers' accounts.

Others found in breach were Alliance & Leicester, Scarborough Building Society, NatWest, United National Bank, Barclays Bank, Co-operative Bank, HFC Bank, and Nationwide Building Society. Each of the firms dumped personal information in bins outside their premises, the ICO found.

Mr Smith said: "It's unacceptable for banks and other organisations to carelessly discard customers' information. It's vital banks and other organisations take security seriously.

"If they do not, they not only risk further action from the Information Commissioner, but also risk losing the trust of customers. Individuals must feel confident banks and other organisations are safeguarding their personal information."

Campaign group Scamsdirect.com last year told the ICO that Natwest and the Royal Bank of Scotland had dumped customers' financial details in bins near two branches in Hampshire.

It told the ICO that cut-up credit and debit cards, money deposit details and bank account information were left. The campaign website also told the ICO it found customers' personal details thrown into a post office bin in a street in Southampton.

These included customers' bank details, National Insurance numbers and passport numbers. The ICO is the UK's independent authority set up to promote access to official information and to protect personal information.

Responding to the ICO's findings, the NCC said: "This is a complete breach of customer trust and shows total disregard for the handling of highly sensitive information, which customers automatically entrust banks with.

"We ask whether banks are now going to notify customers that their personal information may have been compromised?"

A Royal Bank spokesperson said: "The ICO is referring to a handful of historic cases and as soon as we were made aware of these potential breaches we immediately took action.

"We do comply with the Data Protection Act and have invited the ICO to take a look at our security measures."