Protecting Investors’ Personally Identifiable Information Act
- Sponsor
- Sen. Kennedy, John [R-LA]
- Committees
- Banking, Housing, and Urban Affairs Committee (primary)
- Last action
- Feb 20, 2025
Bottom line
The bill aims to enhance investor privacy by restricting the routine collection of sensitive personal data for market surveillance, while preserving the SEC's ability to access such data for targeted enforcement actions under strict destruction requirements.
What it actually does
This bill prohibits the Securities and Exchange Commission (SEC) from requiring national securities exchanges, national securities associations, or their members to collect personally identifiable information (PII) for general consolidated audit trail (CAT) reporting requirements. It creates an exception, allowing the SEC to request PII only for specific investigations into federal securities law violations, with a mandate to destroy the information within one day after the investigation concludes.
Proponents argue
Supporters argue that the bill is essential for protecting investor privacy and preventing potential data breaches by limiting the broad, routine collection of sensitive personal information by the government. They contend it strikes a necessary balance, allowing the SEC to conduct legitimate investigations without maintaining a vast, permanent database of PII that could be vulnerable to misuse or cyberattacks.
Opponents contend
Opponents might argue that restricting the routine collection of PII could significantly hinder the SEC's ability to conduct comprehensive market surveillance, detect sophisticated patterns of market manipulation, and effectively enforce securities laws. They may contend that broad PII collection is a crucial tool for ensuring market integrity and protecting investors from fraud, and that the bill's limitations could create blind spots for regulators.
The bill is very short and clearly written, allowing for a quick and straightforward evaluation by any informed reader.
Section 2(b)
Prohibition on Routine PII Collection for CAT Reporting
This provision explicitly forbids the Securities and Exchange Commission (SEC) from requiring national securities exchanges, national securities associations, or their members to provide personally identifiable information (PII) of market participants for the general requirements of the consolidated audit trail (CAT) system. This means that routine data submissions to CAT would no longer include sensitive details such as names, addresses, Social Security numbers, or IP addresses.
Supporters argue
Supporters argue that this prohibition is crucial for safeguarding individual investor privacy, reducing the risk of large-scale data breaches, and preventing potential government overreach by limiting the aggregation of sensitive personal data in a central database.
Critics contend
Critics may contend that preventing the routine collection of PII could impede the SEC's ability to conduct comprehensive, real-time market surveillance, making it more difficult to proactively identify and track complex, cross-market manipulation schemes.
Tradeoffs
This provision navigates the tension between enhancing individual investor privacy and maintaining the SEC's capacity for broad, proactive market surveillance to detect and prevent fraud.
Section 2(c), (d), (e)
Exception for Investigations and PII Destruction Mandate
This provision establishes a narrow exception to the PII collection prohibition, allowing the SEC to request PII from regulated entities only when it is directly related to an investigation of federal securities law violations or an enforcement action. When such a request is made, the PII must be provided within 24 hours, unless an extension is granted. Crucially, the SEC is mandated to destroy all such PII within one day after the conclusion of the specific investigation or matter for which it was required.