Federal police who accessed a journalist's phone records to find a story's source did not "fully appreciate" their legal responsibilities, a report has found.
There was also a lack of awareness within Australian Federal Police about journalist information warrants designed to protect reporters, the Commonwealth Ombudsman said.
On Anzac Day, the AFP revealed its professional standards unit had accessed a journalist's metadata to get phone records - without getting a warrant.
"A number of officers did not appear to fully appreciate their responsibilities when exercising metadata powers," the ombudsman's report said.
Tuesday's report also found the AFP relied heavily on manual checks and did not have strong controls in place to prevent journalists' metadata being released without a warrant.
News that makes sense
Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.
The breach occurred just weeks after laws came into force requiring Australian telecommunications providers to store two years of metadata on all internet and phone account holders.
In response, the AFP destroyed the data and stopped pursuing the matter.
All authorised AFP officers will now have to undergo a mandatory training package each year on their metadata responsibilities.
Attorney-General George Brandis said the AFP had responded appropriately to the breach, and it was making significant process to ensure it didn't happen again.
The journalist was not told their data had been accessed.
Protections for journalists were introduced as part of the metadata retention laws in April, but in May the Ombudsman found officers throughout the Professional Standards Unit were not aware of them.
