The Data Protection Commissioner has found that there is no lawful basis for retaining information from PSC applications.