US Federal Senate Bill SB658

US Federal 2025-2026 Regular Session

• Introduced: 2/20/25
• Refer: 2/20/25

Caption

Protecting Investors’ Personally Identifiable Information Act

Summary

SB 658, the “Protecting Investors’ Personally Identifiable Information Act,” would limit the Securities and Exchange Commission’s ability to require personally identifiable information to be collected through consolidated audit trail (CAT) reporting. The bill defines personally identifiable information broadly to include items such as a person’s name, address, date or year of birth, Social Security number, phone number, email address, and IP address. Under the bill, the SEC could not require exchanges, securities associations, or their members to provide such information for routine CAT order or reportable-event reporting. The bill creates a narrow exception allowing the SEC to obtain personally identifiable information only when it specifically requests the information in connection with an investigation or enforcement action involving a violation of federal securities laws or SEC regulations. In those cases, the bill requires the information to be produced within 24 hours, unless the SEC grants a reasonable extension, and requires the SEC to destroy the information no later than one day after the investigation or other matter ends. The measure is framed as a privacy protection bill for market participants and investors.

Impact

If enacted, SB 658 would amend the practical operation of SEC consolidated audit trail reporting by prohibiting routine collection of personally identifiable information and limiting access to such data to targeted investigative and enforcement circumstances. It would affect the SEC, national securities exchanges, national securities associations, broker-dealers, and other market participants subject to CAT reporting requirements, while also imposing deletion requirements on the Commission for any PII it receives under the exception. The bill would not eliminate the CAT framework itself, but would narrow the scope of data that can be collected and retained under it.

Sentiment

The available context suggests the bill is being advanced in a generally supportive, privacy-focused posture, with sponsors emphasizing protection of investors’ personal data from broad collection. There are no recorded votes or committee transcripts in the provided materials, so there is no documented floor or committee debate to indicate broader bipartisan or partisan sentiment. Based on the text alone, the bill appears intended to address concerns about data security and overcollection in securities market surveillance.

Contention

The main point of contention is likely the tradeoff between investor privacy and regulatory surveillance. Supporters would view the bill as preventing unnecessary collection of sensitive personal information and reducing the risk of misuse or data breaches, while critics may argue that limiting routine access to identifying information could hinder the SEC’s ability to monitor markets, reconstruct trading activity, and investigate misconduct efficiently. The bill’s exception for investigations and enforcement actions attempts to preserve enforcement tools, but the 24-hour production expectation and destruction mandate may still raise operational concerns for regulators and market infrastructure entities.