S-658-119
Read twice and referred to the Committee on Banking, Housing, and Urban Affairs.
Sponsored by John Kennedy (R-LA)
What it does
The bill would prohibit the Securities and Exchange Commission from requiring exchanges, securities associations, or their members to provide personally identifiable information (such as name, address, birth date, Social Security number, phone, email, or IP address) about market participants under the consolidated audit trail rule (17 CFR 242.613(c)(7)) or any successor rule. The SEC may require it only through a specific request tied to an investigation of a securities-law violation or an enforcement action. Firms would have to respond within 24 hours unless the SEC grants a reasonable extension, and the SEC would have to destroy the information within 1 day after the related matter ends.
Who benefits
Retail and institutional investors whose names, addresses, Social Security numbers, and other identifiers would not be routinely placed in a centralized database that could be breached. Broker-dealers and exchanges that may avoid some costs and liability tied to collecting and transmitting customer identifiers. Privacy-focused groups and members of Congress who have raised data-security concerns about the audit trail system.
Who is hurt
SEC and self-regulatory organization surveillance staff, who might find it harder or slower to link trading activity to specific individuals when looking for manipulation or insider trading. Investors harmed by misconduct that might go undetected or be detected later. Exchanges and brokers that would need to build processes to respond to 24-hour requests and may have to adjust systems already built for the existing rule. The audit trail operator, whose planned customer-identification system could need redesign.
Supporters argue
Supporters argue that a single database holding the personal identifiers of every investor creates a large target for hackers and that the SEC has no need to hold such data before it opens an investigation. They contend the bill preserves the SEC's ability to obtain identifying information quickly, with a 24-hour response requirement and mandatory destruction of the data after the matter ends.
Opponents argue
Opponents argue that regulators need identifying information readily linked to trading records to detect manipulation and insider trading across markets, and that waiting for a request tied to an investigation could slow or prevent detection. They contend the audit trail was designed with security safeguards, and that the bill's one-day destruction rule and limit to open investigations could hinder follow-up work.
Constitutional context
Congress regulates securities markets under the Commerce Clause (Art. I, §8, cl. 3) and may limit what an agency can require by statute, consistent with its legislative power under Art. I, §1. Restrictions on government data collection can also implicate Fourth Amendment privacy principles, as in Carpenter v. United States (2018), though this bill narrows rather than expands collection and raises no clear constitutional conflict.
Checks and balances
Congress would narrow the SEC's rulemaking and data-collection authority, shifting power from the executive-branch agency to the legislature, while courts retain their usual review of how the SEC applies the limits.