New Zealand’s privacy regime is becoming more explicit about how organisations collect personal information, including information gathered indirectly. The