Finra’s promise not to collect personally identifiable information through its proposed Comprehensive Automated Risk Data System does not alleviate security concerns, the Financial Services Institute said today.
The CARD System would “still contain account numbers, which can be matched to [personally identifiable information] at the firm level,” FSI wrote in a blog post.
“Finra will effectively have an investor’s entire financial snapshot consolidated in one central system, making it an attractive target for hackers and fraudsters,” the FSI said.
The controversial CARDS proposal would download customer trade data from clearing firms and allow Finra to analyze it for compliance and exam purposes. CARDS is just a concept at this point, not a formal rule proposal.
After industry observers raised concerns over data security, Finra this month announced that CARDS would not collect personally identifiable customer information.
Even so, clearing firms would still be collecting personal data from customers who do business directly with product sponsors, said FSI spokesman Chris Paulitz.
But Finra’s decision not to collect personal information in the system alleviates the privacy concern, said Barbara Roper, director of investor protection for the Consumer Federation of America, which supports CARDS.
“The industry … had a winner in raising privacy concerns [about CARDS] which they don’t like for other reasons,” Roper said. “They’re reluctant to give up [the privacy argument] in the wake of Finra’s very quick action” in promising not to collect personal data.
Brokerage firms are worried about how Finra would use the data, how it would be secured and the costs and complexity of implementing the system. Roper said firms may also be worried about getting caught with poor compliance.
In its blog post, the FSI added that giving Finra useful feedback will be all but impossible.
“The current proposal does not provide enough specific information about what types of data Finra is seeking to collect and how specifically Finra will use the data,” the FSI wrote. “As a result, firms are likely unable to provide informed responses to the individual requests at this time.”
The comment period for the CARDS concept release ends Friday.
“CARDS is an important concept release and one that Finra feels will help transform the way we execute our investor protection mission,” Finra spokesman George Smaragdis said in a statement. “As such, Finra encourages public comment on this important proposal.”
Smaragdis added that in response to comment letters and discussions with industry participants, Finra decided not to require the submission of information that would identify individual account owners, account names, addresses or tax I.D. numbers.
Smaragdis added that in response to comment letters and discussions with industry participants, Finra decided not to require the submission of information that would identify individual account owners, account names, addresses or tax I.D. numbers.