# The SEC Is Starting a Massive Database of Every Stock Trade 

Brokers will have to report every trade and the trader’s personal information.

February 17, 2023 • Commentary 

By [Jennifer J. Schulp](https://www.cato.org/people/jennifer-j-schulp) 

This article appeared on [*Rea​son​.com*](https://reason.com) on February 17, 2023.

What little financial privacy you have when trading stocks is about to get even smaller next month. When you make a stock trade, your broker already is required by the [Bank Secrecy Act](https://www.cato.org/commentary/government-surveillance-doesnt-stop-banks-door) to maintain records of it, monitor your trading activity, and report any suspicion of illegal activity to the federal government. But, starting in March, your broker will be required to directly report all of your trades, including your personal information, to a massive government database. If the Bank Secrecy Act [concerns](https://www.cato.org/policy-analysis/revising-bank-secrecy-act-protect-privacy-deter-criminals) you—and even if it doesn’t—just wait until you hear about the [Consolidated Audit Trail](https://www.catnmsplan.com/) (CAT).

The Consolidated Audit Trail is intended to collect and accurately identify every order, cancellation, modification, and trade execution for all exchange-listed equities and options across all U.S. markets, allowing the Securities and Exchange Commission (SEC) to track orders and identify who made them.

The SEC ordered the CAT to be created in 2012 after regulators had difficulty identifying the causes of the 2010 “[flash crash](https://en.wikipedia.org/wiki/2010_flash_crash).” At the time, then-SEC Chair Mary Schapiro [described](https://www.sec.gov/news/statement/2012-07-12-open-meeting-statement-mls) the CAT as providing regulators with the “data and means to exponentially enhance \[their\] abilities to oversee a highly complex market structure.” And in years since, the CAT has been championed as necessary for the SEC’s enforcement efforts.

The CAT began collecting trading data in 2020, after years of development replete with [challenges](https://www.iflr.com/article/2a638ls5pmz4hbpv98nwg/primer-the-consolidated-audit-trail) and [controversies](https://www.tradersmagazine.com/am/its-time-for-the-sec-to-step-in-and-reverse-a-securities-industry-debacle/). It is scheduled to begin collecting customer information on [March 17, 2023](https://catnmsplan.com/announcements/update-cais-reporting-deadlines). Although the SEC has [limited](https://www.pionline.com/legislation/senate-gop-bill-seeks-ban-collection-personal-audit-trail-data?utm_campaign=smartbrief) the scope of customer information to be collected—initial plans called for Social Security numbers, dates of birth, and account numbers—brokers must still provide customer names, addresses, and birth years which allows for easy identification of individual investors.

This massive surveillance database is a financial privacy nightmare.

Most of the criticism leveled at the CAT has focused on data security. The CAT will absorb information about tens of billions of trades daily, making it quite possibly the largest database in the world. Its sheer size will be an invitation for criminals, who then-SEC Chair Jay Clayton [recognized](https://www.sec.gov/news/public-statement/statement-clayton-2017-09-20) in 2017 “could potentially obtain, expose and profit from the trading activity and personally identifiable information of investors.”

Brokers will have to report every trade and the trader’s personal information.

The government is hardly immune from hacking; indeed, the SEC itself was hacked [in 2016](https://www.wsj.com/articles/sec-discloses-edgar-corporate-filing-system-was-hacked-in-2016-1505956552). Thousands of users (not just at the SEC) will have access to the CAT, with [vague standards](https://www.aclu.org/sites/default/files/field_document/aclu_letter_to_sec_re_consolidated_audit_trail_0.pdf) guiding their use of the data accessed, creating even more security gaps. And while the SEC [proposed](https://www.sec.gov/rules/proposed/2020/34-89632.pdf) a rule to address some data security concerns in 2020, the agency has taken [no action](https://www.thinkadvisor.com/2023/01/23/march-cat-deadline-raises-investor-privacy-alarm-sec-roundup/) to finalize that rule or anything similar (despite a [flurry](https://thehill.com/opinion/finance/3267550-too-much-too-quickly-from-the-sec/) of other rule making).

But these criticisms seem to assume that if the government had good enough data security, this type of intrusion into Americans’ financial privacy would be acceptable. That’s simply not the case. Personal and financial privacy are key components of life in free societies, where individuals enjoy a private sphere free of government involvement, surveillance, and control. As SEC Commissioner Hester Peirce [recognized](https://www.sec.gov/news/public-statement/peirce-statement-response-release-34-88890-051520):

> Our purchases and sales of securities, particularly when aggregated together as the CAT would do, are a rich form of value expression. They might express a view of how markets work, a determination on the efficiency of markets, expectations about the future, or even a moral philosophy.

Trading is thus an expressive activity, and the CAT raises the same types of civil liberties concerns as any other mass surveillance program. It doesn’t matter if the SEC has good intentions, seeking only to use the CAT to understand our markets better and to enforce existing laws. Financial privacy is vital because it can be the [difference](https://www.ocregister.com/2022/02/24/canadas-plow-through-financial-freedom-stopped-convoy/) [between](https://www.cato.org/briefing-paper/central-bank-digital-currency#financial-freedom) survival and oppression for those who hold disfavored views.

In this way, the CAT burdens not only Americans’ [First Amendment](https://constitution.congress.gov/constitution/amendment-1/) rights of speech and expression but also their rights under the [Fourth Amendment](https://constitution.congress.gov/constitution/amendment-4/) to be free from unreasonable government searches and seizures. Although a 1976 Supreme Court [case](https://supreme.justia.com/cases/federal/us/425/435/) about the Bank Secrecy Act found that information shared with a third party—there, the bank—is not protected by the Fourth Amendment, that doctrine is ripe for revisiting given the [ubiquitous role of intermediaries](https://www.cato.org/commentary/government-surveillance-doesnt-stop-banks-door) in modern life. But even if the CAT’s surveillance isn’t constitutionally deficient, its data collection [is troubling](https://www.sec.gov/comments/s7-10-20/s71020-20138074-308285.pdf) and should be treated no differently than other areas of American life where people [reject](https://www.sec.gov/news/public-statement/peirce-statement-response-release-34-88890-051520) broad-based surveillance of their activity.

This is especially true where the benefit of surveillance seems marginal. The SEC isn’t [without the ability](https://www.wsj.com/articles/why-were-suing-the-sec-11589740995?mod=article_inline) to analyze trading information absent the CAT, although it’s understandably tempting for the agency to want to see every trade in close to real time. Some [have](https://www.sec.gov/comments/s7-10-20/s71020-8157718-226862.pdf) [suggested](https://www.pionline.com/legislation/senate-gop-bill-seeks-ban-collection-personal-audit-trail-data?utm_campaign=smartbrief) [alternatives](https://www.sifma.org/wp-content/uploads/2021/01/Pause-on-Implementation-Related-to-CAT-CAIS-Final-1-28-2021-1.pdf) to prohibit personal information from the database, leaving the SEC to make case-by-case requests of brokers when warranted. This is the minimum the agency could do to protect customer privacy (especially where the SEC is [touting enforcement cases](https://financefeeds.com/sec-used-consolidated-audit-trail-cat-database-to-uncover-47m-front-running-scheme-by-nuveen-trader/) brought with CAT data prior to including personal information). But such solutions leave the surveillance machinery in place; Commissioner Peirce’s suggestions of a more [limited database](https://www.realclearpolicy.com/articles/2019/10/09/this_cat_is_a_dangerous_dog_111285.html) focused on institutional investor trading or [improvements](https://www.sec.gov/news/public-statement/peirce-statement-response-release-34-88890-051520) to already existing systems are better choices to protect the privacy of individual investors.

The CAT threatens American investors’ privacy. Knowing that the SEC is watching your every trade is too great a cost for easier SEC enforcement. Despite the years of planning and expenses already incurred, the SEC should put the CAT back in the bag—or let it out only when declawed—to protect the liberties of American investors.

##### About the Author 

[![New Jennifer Schulp cropped image](/sites/cato.org/files/styles/author_picture/public/2023-03/jennifer-schulp-cropped-2.jpg?itok=kdrnmhHr)](/people/jennifer-j-schulp) 

##### [Jennifer J. Schulp](/people/jennifer-j-schulp)

Former Director of Financial Regulation Studies, Center for Monetary and Financial Alternatives, Cato Institute