Our bank uses a local garage to pick up repos and cleaning up of vehicles. Would this garage and detailer be considered vendors? Do you require a contract with the garage? The privacy of the customer is at risk. What are your thoughts?

I would guess and say yes. What if they found your customers bank statements in the repo car? You need to at least take steps to make sure they are not going to disclose anything they find that could compromise the customer identity. I'd have them sign an agreement of non-disclosure for anything found in the car.

Yes. They are hired by your bank to handle dealings with customers. They know this person had a loan, they know there is a payment problem. This is confidential data aside from anything in the car.