High street finance companies are forcing customers to sign waivers allowing them to seek private information from dozens of government departments and private companies.
Geneva Finance can now seek private information from agencies including the police, Ministry of Justice and Department of Corrections before approving loans.
In one case, the company published a customer's name, date of birth and address online in a bid to track him down.
Privacy watchdogs take a dim view of such access and disclosure.
Assistant Privacy Commissioner Mike Flahive said he would question whether a finance company needed to ask the police if someone had a drink-driving conviction from four years ago and whether this was relevant to whether the person could pay money back.
In the past year, the Ministry of Business, Innovation and Employment has received 20 requests for personal information about taxpayers.
Finance companies can also seek information about clients from telecommunications companies and from past and present employers.
Some loansharks even require clients to sign power of attorney, allowing lenders to make all kinds of financial decisions on a borrower's behalf.
Family Budgeting Services chief executive Raewyn Fox said those who borrowed money from finance companies wouldn't realise they were signing away so much information. "It should ring alarm bells, but when people are desperate for money they don't stop and go through that thought process."
Fox said the next few weeks were the busiest for budgeting services as thousands of people struggled with post-Christmas financial hangovers.
Amendments being made to the Credit Contracts and Consumer Finance Act would force loansharks to make sure that lenders were capable of repaying the loan.
Geneva Finance is already in the Privacy Commission's crosshairs for publishing a customer's private details online.
The company disclosed the client's name, date of birth and address on a public forum while seeking an up-to-date address from a government database.
The commission is investigating and said it appeared to be a clear breach of the Privacy Act. "That's certainly untidy," Flahive said. "The inadvertent or thoughtless use of the internet can create problems."
Geneva Finance said the employee responsible for the breach apologised "profusely" in an email.
What to do if you receive another's files
• Treat it as you would valuable lost property.
• Keep the information safe and don't show it to anyone or copy it - once you have it, you're responsible for its security.
• Send it back to the agency it came from as soon as possible, accompanied by a written complaint. If you don't know which agency it came from, contact the Privacy Commissioner or return it to the person whose information it is.