The State could face class action court cases after the Data Protection Commissioner found the Public Services Card breached data protection laws.
The Commissioner says there's no legal basis for any state agency, other than the Department of Social Protection, to insist someone has the card.
The state has been given 21 days to stop breaching the rules.
Associate Professor of Law at Trinity College Dublin, Eoin O'Dell, says GDPR regulations introduced in May specifically allow class-action case.
He says the legislation added the possibility of class action cases which, while not a feature yet of Irish law, have been introduced for European law reasons in the specific context of a data breach of this nature.
