Miss Vance viewed parts of the report prior to its release and Fairfax revealed the GCSB was spying on 88 New Zealanders.
Parliamentary Service said it handed over the information without Miss Vance's or Mr Carter's permission because it was a "security breach''.
Top public servant David Henry and his team assessed Miss Vance's swipe card information alongside Independent MP Peter Dunne's in an attempt to match their movements.
Parliamentary Service will not say who authorised the release of the swipe card information, or whether it had tracked journalists' movements in the past.
Ms Mutch said they were hoping for a formal agreement from Mr Carter to protect press gallery journalists.
Mr Carter said he was working on some kind of protocol to formalise that and it will be parliament-wide.
Ms Mutch said she asked for the press gallery to be heavily involved in setting that protocol.
The press gallery had also asked for a clarification of the definition of a ``security breach'' by Parliamentary Service.
Prime Minister John Key said previously he did not agree with the decision to release Miss Vance's swipe-card records.