Open Insurance is coming to New Zealand. The conversation so far has been about how insurers share data with each other and with accredited intermediaries. This paper asks a different question: what if the policyholder held it?
The Customer and Product Data Act 2025 is justified on consumer outcomes. Better choice. Easier switching. Fewer protection gaps. Real control over personal information.
The architecture being designed to deliver those outcomes still places carriers at the centre. Data sits with insurers. Consent flows through them. Third parties consume APIs that insurers expose, and the consumer remains a subject of the system, not a participant in it.
This paper proposes a different starting point. A consumer-controlled Insurance Twin: a digital record of a policyholder's insurance position, populated from the carriers they have done business with, owned by them, and used to manage cover, share data on demand, and reuse verified information across the market.
Open Data legislation everywhere is justified on consumer outcomes. In a carrier-mediated model, those outcomes depend on insurers and third parties choosing to deliver them. The consumer is a passive subject of data flows they cannot see, audit, or pause without going back to each insurer individually.
The current direction assumes carriers will modernise their systems to expose APIs at depth and quality. For most New Zealand insurers, this is a multi-year capital investment. The consumer waits. Offshore aggregators with mature plumbing have a clear runway.
Cross-carrier visibility is the only honest answer to underinsurance, double cover, and exclusions consumers did not know they had. No single insurer can deliver this view. None has commercial incentive to. A carrier-centric model perpetuates the fragmentation that produces the problem.
You cannot disintermediate a consumer from their own data store. A locally-domiciled, consumer-controlled Twin is the only architecture that genuinely answers the offshore-aggregator concern.
The Twin sits with the policyholder. Any institutional access is consented, time-bound, revocable, and logged.
The standard is the product. The platform is replaceable. Multiple Twin providers should be able to operate within a shared schema and accreditation regime. Mature international precedents already exist.
Data and governance sit in New Zealand jurisdiction. The structural answer to offshore disintermediation, and the only durable basis for consumer trust.
Default settings, assisted modes, and consent UX should be designed for low digital literacy and high-stakes life events first. If it works for them, it works for everyone.
Start with one or two real problems where cross-carrier visibility changes the outcome. Build the foundations under the use cases, not ahead of them.
Funding comes from institutions that benefit from cleaner, consented data. Not from selling consumer data or attention. Singpass and SGFinDex demonstrate this works.
Policymakers at MBIE shaping the Customer and Product Data Act. The Office of the Privacy Commissioner. The InsurTech NZ board and members. Consumer NZ. The Insurance Council of New Zealand. And the policyholders the system exists to serve.
The paper's value depends on whether the right people read it, push back on it, and sharpen it. If you are working on Open Insurance, digital identity, consumer data rights, or insurance policy in Aotearoa, this is offered as a starting point for a conversation - not a position to defend.