S. 658 — Protecting Investors’ Personally Identifiable Information Act

This section prohibits the Securities and Exchange Commission (SEC) from requiring national securities exchanges, national securities associations, or their members to submit personally identifiable information (PII) (i.e., data such as name, address, date of birth, Social Security number, telephone number, email address, or IP address) of market participants for Consolidated Audit Trail (CAT) reporting under 17 CFR 242.613(c)(7) or any successor regulation, except upon SEC request for an investigation of federal securities law violations or related enforcement actions. (As background, the CAT collects order and trade data from exchanges and broker-dealers to reconstruct market events and support regulatory surveillance.) It further requires provision of requested PII within 24 hours (with possible reasonable extensions granted by the SEC) and mandates SEC destruction of such PII within one day after conclusion of the investigation.