It depends on the position of the person who accessed the prime minister’s account. The way this would work with most computer systems (including several places I’ve worked), you’d be given access because there could very-well be a reason why you’d need to access the customer’s details. But the access would be flagged and reviewed as a routine process.

“Why did you access this celebrity’s details?”
“They came into the branch and were in front of me.”

Very well, carry on.
Obviously if you can’t answer this question correctly, bad things appropriate consequences happen.

We trust these companies with our private details. They need to have systems in place to ensure they are worthy of their trust. At one job, it was my role to drill the Australian Privacy Principles into every single new hire. Reputable companies take this stuff very seriously, and CBA will be no different.

I can imagine that a contractor seconded to CBA, and not a direct hire might have skipped their equivalent induction session. If so, I expect that would be remedied for future secondments.