Some 82 journalists have had their communications data obtained by police under the Regulation of Investigatory Powers Act in three years, the Interception of Communications Commissioner's Office has found.
And the IOCCO has said forces should require judicial approval to do so in the future.
The report, which was partly prompted by the Press Gazette Save Our Sources campaign, reveals that in the last three years 608 RIPA applications have been made by forces for communications data to find journalistic sources.
This figure relates to 34 investigations into "suspected illicit relationships between public officials (sources) and journalists” across 19 police forces.
Some 105 journalists were considered "of interest" in these investigations, and 82 had their data grabbed by police after obtaining internal approval in relation to 24 of the 34 investigations.
The IOCCO revealed that 43 per cent of the data sought on journalists "was traffic or service use data, such as call data on phones (including 31 office landlines), typically for periods of 1 or 2 months".
Other data obtained included "subscriber data" or "data relating to devices used by a journalist's source".
Of the 105 journalists, 69 worked for national newspapers, 19 for the local press, seven were freelance, three were broadcast, one was “new media” and six were “unknown/unspecified”.
Meanwhile, there were 242 suspected sources investigated by police under these 34 investigations, with 233 having their communications data taken under RIPA.
Of the 242 suspected sources, 126 worked for the police, 52 worked as prison officers or secure hospital staff, 38 were military staff, four worked for central or local government , and 22 were “unspecified/unknown”.
Of the 34 investigations, two are ongoing, 20 resulted in no action, five led to criminal action and charges against 68 individuals (including 64 under Elveden), four resulted in no action being taken by prosecutors and in three cases disciplinary proceedings are being planned.
Ten of the investigations that resulted in criminal action also resulted in disciplinary action being taken, with 15 dismissals and five pieces of management advice issued.
The IOCCO noted that 80 per cent, 484, of the RIPA applications related to Operation Elveden, the Metropolitan Police's investigation into inappropriate payments to public officials.
The IOCCO judged that police forces are not “randomly trawling communications data relating to journalists in order to identify their sources”. But the office did say that police forces generally “did not give the question of necessity, proportionality and collateral intrusion sufficient consideration”.
It said that while generally Article 8 (privacy) of the European Convention of Human Rights was considered, Article 10 (freedom of speech) was not.
The report also stated that the Home Office’s draft RIPA code of practice would “not provide adequate safeguards to protect journalistic sources or prevent unnecessary or disproportionate intrusions”.
The report said: “After careful consideration of all the evidence and the sensitivities and complexities of the considerations required when contemplating an interference with Article 10 of the Convention it is recommended that judicial authorisation is obtained in cases where communications data is sought to determine the source of journalistic information.”
The IOCCO launched its inquiry in October, citing Press Gazette's Save Our Sources campaign and petition as one of the reasons for doing so.
The RIPA scandal broke in September, when Press Gazette was the first news outlet to report that The Sun's phone records had been targeted by the Met Police as part of Operation Alice into Plebgate.
Since then, it has emerged that two more Sun journalists had their phone records obtained by the Met under Operation Alice.
In addition, Kent/Essex Police has admitted to using RIPA to find a Mail on Sunday source, and Press Gazette has revealed how Suffolk, Thames Valley and Cleveland forces have also used the act to find journalistic sources.
Last month, Press Gazette co-ordinated a letter sent to the Prime Minister stating that the Home Office's draft RIPA code was not acceptable. It was signed by every UK national newspaper editor.
More then 1,500 people have signed the Press Gazette Save Our Sources petition calling for judicial oversight of police requests to view journalists' call records.
Sir Anthony May, the Interception of Communications Commissioner, said: “In October 2014 due to the serious nature of the concerns reported in the media about the protection of journalistic sources, and the allegations that the police had misused their powers under Chapter 2 of Part 1 of RIPA to acquire communications data the Rt Hon.
"Sir Paul Kennedy, who was at the time acting as interim Commissioner, considered it necessary to launch this inquiry and make an additional report to the Prime Minister.
"I share and fully support the concerns that were raised and have overseen my office’s undertaking of this inquiry since returning to my post as Commissioner on 1st January 2015.
"I am very pleased to be able to publish our inquiry report today and I hope that Parliament and the public will find it helpful.
"Our report sets out the extent to which these powers have been used by police forces to identify journalistic sources, examines the appropriateness of the use of Chapter 2 of Part 1 of RIPA for this purpose, and makes recommendations to ensure adequate safeguards are provided to protect journalistic sources.”