It's a complex situation with a number of protocols that need compliance
Both UKBA and HMRC have authority to undertake "status verification". But they have no mandate to demand personal information nor to demand any specific 'unknown data'.
Basically it covers establishing whether or not a document (bank statement) presented to them is accurate or has been altered.
So for example, they can ask the bank to confirm if an amount of £xxxx was paid into a specific account number on a specific date. The bank is allowed to confirm or deny.
It's just a verification.
The bank will not divulge information, only confirm or deny very specific information that has been presented to the authorities as accurate and true.
