Protecting Investors’ Personally Identifiable Information Act

To prohibit the Securities and Exchange Commission from requiring that personally identifiable information be collected under consolidated audit trail reporting requirements, and for other purposes. 1. Short title This Act may be cited as the Protecting Investors’ Personally Identifiable Information Act 2. Personally identifiable information excluded from consolidated audit trail reporting requirements (a) Definitions In this section— (1) the term Commission (2) the term personally identifiable information (A) means information that can be used to distinguish or trace the identity of an individual, either alone or when combined with other personal or identifying information that is linked or linkable to the individual; (B) includes the name, address, date or year of birth, Social Security number, telephone number, and email address of an individual; and (C) does not include a CAT-Order-ID or CAT-Reporter-ID, as those terms are defined in section 242.613(j) of title 17, Code of Federal Regulations, or any successor regulation. (b) Prohibition Except as provided in subsection (c), the Commission may not require a national securities exchange, a national securities association, or a member of such an exchange or association to provide personally identifiable information with respect to a market participant to meet the requirements relating to an order or a reportable event under section 242.613(c)(7) of title 17, Code of Federal Regulations, or any successor regulation. (c) Exception The Commission may only require a national securities exchange, a national securities association, or a member of such an exchange or association to provide personally identifiable information with respect to a market participant if the Commission makes a request for such information. (d) Request for extension If the Commission makes a request under subsection (c), a national securities exchange, a national securities association, or a member of such an exchange or association shall provide the personally identifiable information that is the subject of the request not later than 24 hours after receiving the request, unless, at the request of the national securities exchange, national securities association, or member of such an exchange or association, the Commission provides a reasonable extension. (e) Destruction of personally identifiable information In the case of personally identifiable information provided to the Commission under a request made by the Commission under subsection (c), the Commission shall destroy that personally identifiable information not later than 1 day after the date on which the investigation or other matter for which that personally identifiable information is required concludes.

Summary: Protecting Investors' Personally Identifiable Information Act This bill prohibits the Securities and Exchange Commission (SEC) from requiring a national securities exchange, association, or a member of either to provide a market participant's personally identifiable information to satisfy the reporting requirements of the Consolidated Audit Trail (which tracks market activity). However, this information must be provided to the SEC upon request. The SEC must destroy the information not later than one day after the conclusion of the matter for which this information was required.