Womack, Joyce, Amodei seek SEC protection of personally identifiable information

U.S. Rep. Steve Womack (R-AR) and three of his colleagues, including U.S. Reps. Dave Joyce (R-OH) and Mark Amodei (R-(NV), want the Securities and Exchange Commission (SEC) to prohibit the collection and stockpiling of the personally identifiable information (PII) of millions of American investors that is set to occur under the Consolidated Audit Trail (CAT) project.

The CAT, which has the primary purpose of enhancing regulatory oversight of the nation’s securities markets,  is a data management platform that tracks all trade information from broker deals, trading venues, retail investments, and stock exchanges. Starting in July 2024, the CAT will collect the PII of every American with money in the stock market, according to information provided by Rep. Womack’s office.

“A database that unnecessarily stores the personal information of millions of Americans might as well be a flaming target for hackers and foreign adversaries,” Rep. Womack said on Wednesday. “The SEC should eliminate any plans to collect this sensitive data. This is fundamentally about protecting the public.”

The congressman and his colleagues noted in a Nov. 2 letter sent to SEC Chairman Gary Gensler that despite receiving several warnings from members of Congress and industry participants about the risks associated with collecting PII, the SEC has not acted to prohibit the collection of the sensitive personal and financial information of virtually every American investor.

They also noted that once fully operational, the CAT will become “a soft, highly desirable target” for cybercriminals, especially those supported by the Chinese Communist Party, Russia, and other state actors.  

The most effective way to mitigate such threats is for the SEC to prohibit the collection of any PII by the CAT and make clear to financial institutions that they will not be forced to hand over the personal information of their own customers to the CAT, the lawmakers wrote. 

“We expect the SEC to take action to protect the PII of American investors as swiftly as possible,” according to their letter, which is supported by the American Securities Association.