Bank's customer is a water utility company. Can the checks cleared through that account be mined to create a marketing list if the payor is not a bank customer as well?

Sure it can, until your customer's customer figures it out and then you have to explain to the press and your customers what you have been up to. IMHO, it's just a bad business practice.

Agree. I have been combing through various Privacy, Information Security, Data Governance rules trying to find something that remotely prohibits this....still searching.

Thank you.

I believe you will find it under Regulation CS AKA common sense.