The State could be facing multimillion euro payouts after it was found to have illegally retained the personal data of 3.2m people in the rollout of its Public Services Card (PSC).