Cybersecurity Policy Report, EXCHANGES AND MARKET REGULATION—W.D.Tex.: The Panopticon is here: Legal org sues Gensler over CAT rule, (Apr 19, 2024)

By Rodney F. Tonkovic, J.D.

The complaint says the CAT rule is "the greatest government-mandated mass collections of personal financial data in United States history."

The National Center for Public Policy Research filed a complaint looking to block the SEC's Consolidated Audit Trail regulation. The NCPPR says that it is challenging the SEC's "shocking arrogation of power" to impose dystopian surveillance and suspicionless seizures and searches on millions of American investors. The complaint argues that the Commission lacks any authority, history, or oversight structure that would allow it to seize and surveil investors' private information. The complaint asks that the court declare Rule 613 to be null and void and that its implementation be enjoined (Davidson v. Gensler, April 16, 2024).

CAT rule. The SEC added Rule 242.613 in Release No. 34-67457 in 2012. The rule requires national securities exchanges to submit an NMS plan to implement a consolidated audit trail. The rule requires that the system be able to collect and accurately identify every order, cancellation, modification, and trade execution for all exchange-listed equities and equity options across all U.S. markets, from the time of order inception through routing, cancellation, modification, or execution.

CAT suit. The complaint argues that the SEC, with no statutory authority, adopted Rule 613, which has created what would be the largest database of securities data ever. The plaintiff National Center for Public Policy Research ("NCPPR") likens the operation of the rule to Jeremy Bentham's "Panopticon," a prison system featuring 24-hour surveillance. While the Panopticon would only apply to prisoners, the SEC's scheme seizes personally identifiable records for everyone who trades on an American exchange. There is nothing, the complaint says, in the securities laws that gives the SEC the power to regulate the investment decisions of Americans or to gather all investment data from them or their brokers.

By seizing Americans' private financial information and storing it in a giant database accessible by government and non-government entities, the SEC has conjured into being what the Constitution was meant to prevent, the NCPPR says. Invoking the Founders' intent, the complaint says that the government has no authority to peek into, let alone seize, a person's private papers, but the SEC—a mere administrative agency—has arrogated itself that power.

The NCPPR argues that the court must exercise its Article III duties to declare the CAT unconstitutional under the Vesting Clause, art. I, §1; the Taxing and Appropriations Clauses of Article I; and the First, Fourth, and Fifth Amendments. In addition, the complaint says that the CAT scheme also bypasses Congress’ power of the purse to erect a scheme whereby the SEC extracts funds from self-regulatory organizations to fund and operate the CAT.

The SEC, the complaint says, has limited authority to obtain private citizens' confidential information. Rule 613, however, represents a radical break from these historical limitations to give the Commission real-time access, without a warrant, subpoena, or suspicion of wrongdoing, to investors' every move.

Moreover, cybersecurity concerns abound. Inevitable data breaches will expose investors' information to third parties and potentially to catastrophic financial loss. The CAT database is an attractive target for cyberhackers, the complaint says, and this concern has been the subject of several Congressional hearings.

Relief. Overall, the SEC's authority to establish a national market system did not contemplate a vast surveillance program such as the CAT, the NCPPR says. Each plaintiff in the proposed class (i.e., everyone in the CAT database) has a property right in its personally-identifiable information relating to its investments and business records and as well as an expectation that that information will remain private.

The complaint seeks an order certifying the class and declaring Rule 613 null and void. The complaint also asks that the SEC be enjoined from enforcing Rule 613 and that all information obtained pursuant to the rule be expunged from all databases.

The case is No. 6:24-cv-00197-ADA-DTG.

Attorneys: Mark D. Siegmund (Cherry Johnson Siegmund James LLC) for National Center for Public Policy Research, Erik Davidson and John Restivo.

Companies: National Center for Public Policy Research; Consolidated Audit Trail, LLC

MainStory: TopStory CyberPrivacyFeed DataPrivacy DataSecurity ExchangesMarketRegulation SECNewsSpeeches TexasNews