Can my credit union pull my husband's credit report without his authorization?

I went to my credit union to obtain pre-approval for an auto loan. My husband and I have joint checking & savings accounts with them. I have been a member for 2 decades & have had 2 previous auto loans with them. I have never had any difficulty obtaining a loan or any other service from them. When I applied for the pre-approval, all that was required was that I fill out an "update" form which asked for the following: Name, SSN, Spouse Name (not listed as "Optional"), Address & Phone, Current Employer & Pay Rate, Loan Amount Requested, and "Other Bills". I was turned down for pre-approval. When I went to the credit union to pick up my credit report, I found out that they ran my husband's credit report also. He has a repo from 2005 & I believe this is why they did not give me a loan. They must have gotten his ssn & other info from our customer account file. He was not to be affiliated with my loan application in any way. Is there any appropriate action I can take with the credit union?