I agree with Andy- if you are in an Opt Out Bank, I think you can qualify it as an exception based on the fact that the information is being used to complete a customer's request of for a loan. However, this is an extremely argumentative portion of the privacy bill, and you can pretty much split the decision right down the middle.
I think it would be in your best interest to get customer consent in some written form....you do not want to deal with a customer who never "formally" consented to the release of their information and they are denied the loan....angry customers blame everyone for their denial except themselves.
You also have this issue- loan A is made to Mary and Bob, Bob is seeking to refinance the loan in just his name since he has better credit than Mary and can get a better deal alone. Bob handles all of the household finances, and had no problem with you requesting payoff from his other bank. But, Mary, has no idea you will be digging into her personal information and when she finds out, she blows a gasket....then what do you do? You have virtually lost 4 customers---Mary and Bob, b/c Mary insists the accounts be moved and she is telling her sister who will move her bank accounts and her best friend. You get the idea.
Getting written authorization is just the best way to go- in my opinion. One simple form, easy to sign, takes 2 seconds, and you are done.
Good Luck in whatever you decide to do.
p.s. Kirchman---from what I can find out they have been taking the most conservative narrow approach to any one entity out there when it comes to Privacy...in my personal opinion.