Title: Protecting Investors’ Personally Identifiable Information Act
Policy area: Finance and Financial Sector

Summary:
Protecting Investors' Personally Identifiable Information Act
This bill prohibits the Securities and Exchange Commission (SEC) from requiring a national securities exchange, association, or a member of either to provide a market participant's personally identifiable information to satisfy the reporting requirements of the Consolidated Audit Trail (which tracks market activity). However, this information must be provided to the SEC upon request. The SEC must destroy the information not later than one day after the conclusion of the matter for which this information was required.

[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[S. 1209 Introduced in Senate (IS)]

<DOC>






117th CONGRESS
  1st Session
                                S. 1209

To prohibit the Securities and Exchange Commission from requiring that 
  personally identifiable information be collected under consolidated 
      audit trail reporting requirements, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             April 19, 2021

   Mr. Kennedy (for himself, Ms. Lummis, Mr. Rounds, Mr. Moran, Mr. 
  Daines, Mr. Cramer, and Mr. Boozman) introduced the following bill; 
which was read twice and referred to the Committee on Banking, Housing, 
                           and Urban Affairs

_______________________________________________________________________

                                 A BILL


 
To prohibit the Securities and Exchange Commission from requiring that 
  personally identifiable information be collected under consolidated 
      audit trail reporting requirements, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Protecting Investors' Personally 
Identifiable Information Act''.

SEC. 2. PERSONALLY IDENTIFIABLE INFORMATION EXCLUDED FROM CONSOLIDATED 
              AUDIT TRAIL REPORTING REQUIREMENTS.

    (a) Definitions.--In this section--
            (1) the term ``Commission'' means the Securities and 
        Exchange Commission; and
            (2) the term ``personally identifiable information''--
                    (A) means information that can be used to 
                distinguish or trace the identity of an individual, 
                either alone or when combined with other personal or 
                identifying information that is linked or linkable to 
                the individual;
                    (B) includes the name, address, date or year of 
                birth, Social Security number, telephone number, and 
                email address of an individual; and
                    (C) does not include a CAT-Order-ID or CAT-
                Reporter-ID, as those terms are defined in section 
                242.613(j) of title 17, Code of Federal Regulations, or 
                any successor regulation.
    (b) Prohibition.--Except as provided in subsection (c), the 
Commission may not require a national securities exchange, a national 
securities association, or a member of such an exchange or association 
to provide personally identifiable information with respect to a market 
participant to meet the requirements relating to an order or a 
reportable event under section 242.613(c)(7) of title 17, Code of 
Federal Regulations, or any successor regulation.
    (c) Exception.--The Commission may only require a national 
securities exchange, a national securities association, or a member of 
such an exchange or association to provide personally identifiable 
information with respect to a market participant if the Commission 
makes a request for such information.
    (d) Request for Extension.--If the Commission makes a request under 
subsection (c), a national securities exchange, a national securities 
association, or a member of such an exchange or association shall 
provide the personally identifiable information that is the subject of 
the request not later than 24 hours after receiving the request, 
unless, at the request of the national securities exchange, national 
securities association, or member of such an exchange or association, 
the Commission provides a reasonable extension.
    (e) Destruction of Personally Identifiable Information.--In the 
case of personally identifiable information provided to the Commission 
under a request made by the Commission under subsection (c), the 
Commission shall destroy that personally identifiable information not 
later than 1 day after the date on which the investigation or other 
matter for which that personally identifiable information is required 
concludes.
                                 <all>