A leading data protection expert has questioned the legal basis for the public services card, arguing no piece of legislation specifically mandates its introduction or use.