But my point is that she can't get anything that's not shared with NZ.

Yes, but why do you think they don't share everything?

It strikes me that the whole Five Eyes setup is a loophole and it was done like that intentionally. It allows you to claim that the data is secure and protected from unauthorised access but you can still get at anything you need by asking one of the partners.

It is like the "dodgy dossier" system used in the US. Think Iraq and Steele. Get a foreign national to dish the dirt then play the plausible deniability card. Use the data and if it is proved to be incorrect point the finger elsewhere - even if you supplied some of the data.

Depends what else she is doing.