The answers, without a shadow of the doubt, are that the people who owned the data before "AI" was applied still own the data.
As for a breach of Te Tiriti, I am considerably more concerned about the intended outcome of the research being a treaty breach in itself, than in the vendor breaching the treaty in a nuanced way.
The basic competence of everyone involved is the concern. This is central government advising Police, and they're framing the discussion as if data ownership is in doubt.