There is a reply from someone called @Kaithar (https://twitter.com/Kaithar/status/361765029848170496) which says "actually, DPA does mean they need to be able to read your account password, the one setup for over-the-phone auth"

Surely that can't be true? DPA shouldn't give them the ability to read our passwords, only the ability to save DOB, payment type (direct-debit etc) so you can validate that. But not passwords.