After a trash bag containing confidential information about individuals suffering from gambling addiction was reportedly found outside one of Ladbrokes’ betting shops in Scotland, the UK Gambling Commission is apparently considering launching an investigation into the British sportsbetting and gaming operator’s data protection measures.

According to The Guardian, sensitive information including names, addresses, and photos, was discovered by a passerby outside one of the betting shop’s branches in Glasgow. Ladbrokes says that it typically collects personal data such as that from its sportsbetting shops and it is securely disposed of via a company-wide procedure.

The data reportedly included information regarding customers who elected to sign up for Ladbrokes’ Multi Operator Self-Exclusion Scheme (MOSES), through which customers can opt to voluntarily ban themselves from placing bets. The news agency cites information on MOSES which reads, “Your personal details are kept confidential and only shared with the participating bookmakers their group companies’ and the central team administrators.”

Bookmakers reportedly maintain information about clientele who are part of the MOSES system to aid betting shop staff in identifying those individuals who should not be allowed to engage in betting. In addition to names, addresses, and photos, information regarding the reason for choosing exclusion is included; however, bank account numbers or detailed betting history is not.

The Guardian reports that the Gambling Commission said it’s looking into the situation to try to determine why material containing such sensitive information wasn’t disposed of in a way that would ensure that their customer’s personal information was safeguarded.

Tim Miller, the executive director of the Gambling Commission said, “Customers trust that their personal data will be collected carefully and then protected properly.” He said, “We expect gambling operators to adhere to all data protection laws or regulations, which are enforced by the Information Commissioner’s Office (ICO).” And finally, “In an instance where personal data has been breached, we would expect operators to do whatever they can to mitigate any harm caused,” as reported by The Guardian.

While Ladbrokes failed to comment on how the information found its way in a trash bag on the street, a spokesman did reportedly say, “We are taking this extremely seriously and [are] undertaking a full investigation.”

According to the news agency, it is understood that Ladbrokes has written to all of its betting shops to remind them of the importance of properly disposing of sensitive information. Ladbrokes has also, according to the Scottish Sun, begun an internal investigation to ensure that the company’s procedures are as leak-proof as possible.

In addition to the industry-wide self-exclusion scheme MOSES, individual bookmakers also use their own self-exclusion scheme. MOSES is managed by the Senet Group, a responsible-gambling body founded in 2014 by four major bookmakers. Gambler’s voluntary addition to the self-exclude list is for a period of one year and can’t be reversed during that time. When the year is up, unless requested by the customer, the self-exclusion remains intact for an additional six months.