PHOTO: Under New Zealand’s Privacy Act 2020, personal information must be collected directly from the individual concerned. FILE
Australian data platform iD4me has launched in New Zealand, providing real estate agents access to verified homeowner contact details. But privacy experts warn this platform poses a serious compliance risk for agents, who may unknowingly be handling personal information illegally.
“Personal information should generally be collected directly from the individual concerned.”
— Principle 4, Privacy Act 2020 Privacy Commissioner
“An agency that holds personal information must not keep that information for longer than is required for the purposes for which the information may lawfully be used.”
— Principle 9, Privacy Act 2020 Privacy Commissioner
1. Direct Collection Is Required
Under New Zealand’s Privacy Act 2020, personal information must be collected directly from the individual concerned, unless a clear exception applies (Principle 4). Agents relying on iD4me may be using information gathered from third-party sources without explicit consent, which could be a direct breach of the law.
2. Data Retention Limits
The Act also mandates that personal information cannot be kept longer than necessary for the purpose it was collected (Principle 5). There is no clarity on how long iD4me retains homeowner data, making it likely that retention policies do not meet the Privacy Act’s requirements.
3. Consent Is the Key Issue
iD4me’s model assumes homeowners have implicitly agreed to have their contact details used for marketing. In reality:
-
Most homeowners have not explicitly consented to have their information shared with agents.
-
Using this data could expose agents to complaints to the Privacy Commissioner, fines, and reputational damage.
A New Zealand privacy consultant, states: “Agents may think the data is safe because it is verified, but without explicit consent, using it could be a serious violation of the Privacy Act.”
4. What Agents Must Do
-
Avoid using iD4me data until consent issues are clarified.
-
Ensure any personal data used is collected directly from the homeowner.
-
Check retention policies comply with the Privacy Act 2020.
Until these requirements are clearly met, using iD4me could put agents at legal and ethical risk.
🚨 Privacy Red Flags: iD4me’s Australian Footprint Raises Concerns for New Zealand
Before expanding into Aotearoa, iD4me operated across Australia as Id4Me Pty Ltd, a data-aggregation business claiming access to over 19 million mobile numbers and email addresses for real-estate prospecting.
Although there are no confirmed privacy regulator actions against iD4me in Australia, the wider data-broker sector there has faced scrutiny for practices that appear to breach core privacy principles — notably, the requirement to collect personal information directly from the individual concerned.
According to the company’s own FAQs, iD4me sources data from “marketing companies, data aggregators, and data suppliers” rather than individuals themselves. This approach raises significant compliance questions under both Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020, which both state that personal information should be collected directly from the individual unless it is unreasonable or impracticable to do so.
In Australia, the Office of the Australian Information Commissioner (OAIC) has repeatedly warned that large-scale “data enrichment” or “profiling” databases may be unlawful if they aggregate or trade data without genuine, informed consent.
Meanwhile, public sentiment shows widespread distrust — with over 70 percent of Australians saying they feel they have little or no control over how their personal data is shared.
For New Zealand, this context matters. If iD4me’s data pool includes information obtained indirectly — without explicit consent — its operations may fall short of local legal standards, including Principle 2 (Collection of Personal Information) and Principle 9 (Retention of Personal Information) of the Privacy Act 2020.
Real-estate professionals using this platform should exercise caution. While iD4me markets its homeowner data as “verified,” there is little public evidence explaining how this consent was obtained or how long information is retained.
In practice, this could expose Kiwi agents to privacy complaints, reputational damage, or regulatory scrutiny if personal data is accessed or used outside the bounds of NZ law.
-
On online forums (e.g., Reddit) users claim that iD4me (or “ID4Me”) is being used to access very detailed personal information (phone numbers, email, address, even tribunal/court mentions) by real-estate agents. Reddit+1
“There is a database used by real estate agents called ID4Me. This database contains huge amounts of personal information … no safeguards to protect personal information being accessed by anyone using the system.” Reddit
While anecdotal, these suggestions raise concern about how data is being aggregated, how widely it’s being shared, and whether consent/rights are managed. -
More broadly, Australians report low confidence in control over their personal information. For instance, one survey found >70 % say they have “very little or no control” over what data companies share. Mirage News+1
If consumers feel powerless over their data, databases like this operate in an environment of trust vulnerabilities.
⚖️ Key Takeaway
In New Zealand, personal information must be collected directly from the individual and held only as long as necessary for its original purpose.
Any platform that aggregates homeowner data from third-party sources risks falling foul of these core privacy principles — regardless of how “verified” the data may appear.