You haven't fully understood what I tried to convey. Whilst it is true that the data can only be copied from the data store for a restrictive reason, such as ensuring the security of the data store, once it is outside that store, it is no longer protected by the limitations.
So this sequence of events is possible, and legal:
+ Data store data is taken off site for a legitimate reason, such as validation, by the correct department.
+ The police upload from a suspect's CovidSafe app, as a matter of policy, to help protect the public.
+ The police issue a data request, such as under the recently passed AABill law, from the Health Department.
The protections around the data only refer to it in two ways: App data, when it is on the phone, or when referencing it in regards to the Data Store in Canberra. Once it leaves, it is no longer protected.
The definitions refer to the data in terms of location, if that location changes, then it's out of those protections.