Sponsors (9)
The bill strengthens privacy protections for individuals' personal data and reduces some compliance exposure for firms, but it does so at the cost of faster timeframes and narrower routine access that may weaken regulators' ability to investigate and enforce against market abuse.
Middle-class families and other market participants: their personal identifying information (name, SSN, address, IP, etc.) will no longer be routinely included in the Consolidated Audit Trail and must be destroyed quickly after an investigation ends, reducing the risk of mass data exposure and long-term retention.
Financial institutions and exchanges: the bill narrows when they must hand over personally identifiable information, lowering ongoing compliance obligations and potential liability for exchanges and their members.
Taxpayers, investors, and regulators: restricting routine PII collection and requiring rapid destruction after an investigation could hinder the SEC's ability to detect, reconstruct, or analyze market abuse across related matters, reducing enforcement effectiveness.
Financial institutions and exchanges: the requirement to produce PII within 24 hours when requested may create operational strain, accelerate costs for data retrieval and transfer, and increase short-term compliance burdens.
Based on analysis of 2 sections of legislative text.
Prohibits the SEC from requiring exchanges, national associations, or their members to submit investors’ personally identifiable information (PII) as part of consolidated audit trail (CAT) reporting, except when the SEC itself requests PII for an investigation or enforcement action. When the SEC requests PII for such enforcement purposes, the exchange, association, or member must provide the information within 24 hours (unless given an extension), and the SEC must destroy the PII no later than one day after the investigation or matter ends. Defines PII to include common identifiers (name, address, birth date or year, Social Security number, phone, email, IP address) and any data that can be used to distinguish or trace an individual alone or when combined with other data. The law limits routine collection of PII for CAT reporting while preserving SEC access for investigations under tight timing and destruction rules.
Introduced February 20, 2025 by John Neely Kennedy · Last progress February 20, 2025