The Commonwealth Bank must overhaul its privacy practices as part of a court-enforceable undertaking with the Australian Information Commissioner following two data breaches.