Yes, all companies must follow strict rules and procedures from the privacy act prior to defaulting you. By Law if they haven’t, and if there’s been a breach; than it is grounds to have the black mark permanently removed.