HR-1483-119
Placed on the Union Calendar, Calendar No. 687.
Sponsored by Barry Loudermilk (R-GA)
What it does
This bill would prohibit the Securities and Exchange Commission from requiring exchanges, associations, or their members to submit personally identifiable information—such as names, addresses, birthdates, Social Security numbers, phone numbers, emails, or IP addresses—about market participants under the Consolidated Audit Trail reporting rule. The Consolidated Audit Trail is a database designed to track securities orders and trades across markets to detect fraud and manipulation. The bill would not eliminate the audit trail system itself, only the requirement to include this identifying data within it.
Who benefits
Individual retail investors and market participants whose personal data would no longer be collected in a large centralized government-accessible database, reducing exposure to potential data breaches or misuse. Broker-dealers, exchanges, and associations that currently bear compliance and cybersecurity costs of collecting and safeguarding this data would also benefit from reduced regulatory burden.
Who is hurt
The SEC and other regulators could face reduced ability to link specific trades to specific individuals when investigating insider trading, market manipulation, or fraud, potentially slowing enforcement investigations. Investors harmed by fraud schemes that rely on cross-referencing identity data for detection may see slower or less complete regulatory responses.
Supporters argue
Supporters argue that the Consolidated Audit Trail creates an unprecedented centralized repository of sensitive personal data on tens of millions of investors, making it an attractive target for hackers and foreign actors, as data security experts and industry groups have warned since the rule was finalized. They contend regulators can still track and investigate suspicious trading using account identifiers and broker records without also warehousing Social Security numbers and other identifying details that create needless breach risk.
Opponents argue
Opponents argue that removing personally identifiable information from the audit trail could hamper the SEC's ability to quickly and definitively link trading patterns to specific individuals during fraud and manipulation investigations, potentially slowing enforcement. They contend the SEC already has cybersecurity safeguards in place and that the benefits of a complete, identity-linked audit trail for market oversight outweigh the theoretical breach risk, which can instead be addressed through stronger data security requirements rather than removing the data entirely.
Constitutional context
Congress has authority to regulate securities markets under the Commerce Clause (Art. I, §8, cl. 3), and this bill exercises that power by directly restricting an SEC rule rather than raising a novel constitutional question; post-Loper Bright, courts would independently assess whether the SEC's original data collection exceeded its statutory authority under the Securities Exchange Act, though this bill resolves that question legislatively rather than through litigation.
Checks and balances
Congress would use its legislative authority to constrain an existing SEC regulation, reducing agency discretion over data collection design while leaving the agency's core audit trail authority intact.
Historical precedent
Congress and industry groups have previously pushed back on the SEC's Consolidated Audit Trail rule since its 2016 adoption, including litigation and comment-period objections over data security and cost allocation, though no prior statute has specifically barred PII collection under this rule.