The State could be facing millions in legal costs after it was found to have breached data protection laws in the rollout of the Public Services Card.

Yesterday, the Data Protection Commissioner found the card’s remit should not have been extended beyond the Department of Social Protection.

The Commissioner said any data illegally held by the State has to be destroyed within 21 days.

Associate Professor of Law at Trinity College, Eoin O’Dell, says he expects the government to appeal the Commissioner’s findings.