Hi Hana,
I understand that you probably feel as though your privacy has been breached, but legally a bank's duty regarding an individual's personal information only requires that they adhere to certain rules regarding the collection, use, disclosure, security, and access to personal information. It does not necessarily extend to ensuring that an unauthorised disclosure does not occur. As long as they have not been grossly negligent and did not do it intentionally they probably haven't breached any privacy laws. If you are really concerned you can contact the Office of the Australian Information Commissioner and make a complaint.
