Washington, D.C. – U.S. Senator Katie Britt (R-Ala.), a member of the Senate Committee on Banking, Housing, and Urban Affairs, has joined forces with Senator John Kennedy (R-La.) to request that the Government Accountability Office (GAO) conduct an investigation into the potential risks, constitutional issues, and privacy concerns raised by the Securities and Exchange Commission’s (SEC) Consolidated Audit Trail (CAT).
The CAT, a system designed to track trades across American markets, has been in operation for over a decade, offering regulators access to valuable investor information and trade activity data. However, among the vast amounts of data collected by CAT, there lies a critical concern – the personally identifiable information (PII) of every investor trading on U.S. stock exchanges. The collection of such sensitive information raises substantial consumer privacy concerns, as it can be employed to construct a comprehensive profile of an individual’s trading activity and may be vulnerable to potential data breaches.
In their letter addressed to Gene Dodaro, the Comptroller General, Senators Britt and Kennedy have called for a comprehensive GAO investigation to report on various key aspects of the CAT, including the constitutionality and legality of the collection of personal and financial information, the cyber vulnerabilities associated with the CAT database, and an estimation of the number of individuals who will have regular access to the information stored in the database.
The Senators have expressed their concerns over the CAT’s collection of PII, as it poses potential threats to Fourth Amendment protections against “unreasonable search and seizures.” The mandated production of certain information, as per the Fourth Amendment, has previously been a matter of legal contention. The Senators contend that there are legitimate reasons for individuals not to want their financial transactions regularly submitted to a government registry, and they believe the SEC has not adequately addressed these concerns.
The GAO’s forthcoming report, as requested by Senators Britt and Kennedy, will delve into several critical dimensions:
– An analysis of the constitutionality and legality of collecting American investors’ personal and financial information by a regulator in a centralized database without evidence of wrongdoing.
– An examination of the cyber vulnerabilities associated with the CAT database.
– An estimation of the total number of individuals with regular access to data collected under CAT, their professional affiliations, and the screening or background check processes implemented by the SEC and FINRA to vet those with access to the CAT database.
– A comprehensive list of publicly reported cyberattacks on federal government agencies over the last three years and an analysis of compromised or potentially compromised American investors’ PII, including the cost associated with repairing the identities of affected individuals.
– An analysis of the legal entities that retail investors may hold liable for a cyberattack on the CAT, should such an incident result in the theft of American investors’ account numbers, identities, and/or securities holdings, along with an assessment of the potential costs based on previous identity theft data.
The Senators have requested a response from the GAO no later than November 15, 2023, emphasizing the importance of this matter. This collaborative effort by Senators Britt and Kennedy underscores the significance of safeguarding the privacy and constitutional rights of American investors in the digital age.
