WASHINGTON (February 21, 2025) – MADISONVILLE, La. – Sen. John Kennedy (R-La.), a member of the Senate Banking Committee, introduced the Protecting Investors’ Personally Identifiable Information Act. The bill would protect information that could reveal the identity of American investors by prohibiting the Securities and Exchange Commission (SEC) from requiring brokers to submit investors’ personally identifiable information to its Consolidated Audit Trail (CAT).
Earlier this month, the Trump administration’s SEC issued an order that exempts certain personally identifiable information consisting of investors’ names, addresses and years of birth from CAT reporting. Kennedy’s bill would permanently remove reporting requirements on investors’ personally identifiable information.
“Americans assume their private information is secure when they invest money in the U.S. stock market. However, the SEC’s unlawful Consolidated Audit Trail could put their data in jeopardy. My bill would protect American investors from foreign enemies and bad actors by preventing the SEC from collecting personal information it doesn’t need and storing it on a dangerous database,” said Kennedy.
Rep. Barry Loudermilk (R-Ga.) introduced the bill in the House of Representatives.
“The SEC’s collection of personal financial information through the Consolidated Audit Trail is unconstitutional and entirely unnecessary; and it exposes American investors to serious cybersecurity risks from foreign adversaries and criminal hackers. This is why I developed the Protecting Investors’ Personally Identifiable Information Act in the House. The bill would effectively eliminate the potential for both accidental and intentional breaches by restricting the SEC’s automatic collection of investors’ PII. Among its provisions, the SEC will only be permitted to request this data in cases directly tied to investigating or enforcing violations of federal securities law. I want to thank Senator John Kennedy for introducing the Senate companion to this important bill,” said Loudermilk.
Sens. John Boozman (R-Ark.), Katie Britt (R-Ala.), Tom Cotton (R-Ark.), Steve Daines (R-Mont.), Jerry Moran (R-Kan.), Pete Ricketts (R-Neb.) and Mike Lee (R-Utah) cosponsored the bill.
“Investors rely on the SEC to safeguard sensitive financial information. Requiring brokers to submit investors’ private, identifiable information, including social security numbers, into a central database will invite even more attempts to compromise Americans’ data privacy. I am pleased to join my colleagues to reject this ill-advised scheme and protect personal information,” said Boozman.
“The SEC’s Consolidated Audit Trail database holds millions of Americans’ sensitive financial information. Since taking office, I’ve pushed back against the profound risks the CAT poses to Americans’ individual liberty and personal privacy. The Protecting Investors’ Personally Identifiable Information Act would permanently prohibit the requirement of submitting personal information to the CAT, protecting American investors,” said Britt.
“Investors put their faith in the U.S. when they choose to invest in our stock market, and they should not have to worry about their personal information being stolen. This bill will increase our cybersecurity and stop the over-collection of unnecessary personal information for the millions of people who trust our stock market system with their savings and their privacy,” said Daines.
“Protecting the information of American investors helps build trust and security that encourages investments in our markets. As adversaries target Americans’ personal data through cyberattacks, it is important that the SEC only keeps the data it needs instead of housing additional, personal information that could place investors at greater risk,” said Moran.
“The Protecting Investors’ Personally Identifiable Information Act is a necessary step in protecting the information and identities of American investors. The American people should feel confident that their participation in the stock market does not mean the leaking of their private information,” said Ricketts.
The American Securities Association (ASA) supports the Protecting Investors’ Personally Identifiable Information Act.
“Senator Kennedy is a true champion for the American people and we applaud his bill to stop the federal government from collecting individual investors’ personal and financial information in a national registry, which is a sitting duck for hackers. The SEC can conduct responsible oversight of our equity markets without collecting the most sensitive personal information of working families, retirees, and savers,” said Chris Iacovella, CEO of the ASA.
The SEC’s CAT became operational on May 31, 2024, making it the largest government database of its kind. The CAT will collect all customer and order information for equity securities and listed options, including data that might be considered personally identifiable information.
The SEC is implementing the CAT despite concerns from investor protection groups and the securities industry and in the wake of vulnerabilities that recent cyber-attacks have revealed at federal agencies.
Kennedy’s bill would prohibit the SEC from requiring market participants to submit investors’ personally identifiable information to the CAT. Under this legislation, the SEC can obtain personally identifiable information related to investors only by requesting it on a case-by-case basis. Companies and investors trading on the U.S. stock exchanges would need to fulfill the SEC’s request for this information within 24 hours, though additional time may be requested.
The bill would also require the SEC to delete personally identifiable information once the agency resolves the investigation or issue that required that information.
Text of the Protecting Investors’ Personally Identifiable Information Act is available here.
