A just-released report from the Securities and Exchange Commission’s Office of Inspector General confirmed what the American Securities Association has warned for years: The people with access to your most sensitive financial data cannot be trusted to protect it. A former SEC employee improperly accessed and shared nonpublic investigative information, the latest in a long line of insider breaches that make the Consolidated Audit Trail not just a privacy risk, but a ticking time bomb. As the SEC continues to hear from Americans about what to do with the largest collection of their personal financial data ever assembled, the answer is simple: end it. Because it never had the legal right to collect any of it.

The CAT was created in 2012 to replace a fragmented patchwork of trading records with a single, unified audit trail. That was a reasonable goal. What followed was not. The commission built a system that sweeps up every investor’s name, address, date of birth, Social Security number, account numbers, and complete trading history — then stitches it all together with a government-issued tracking identifier called the Customer and Account Identifier, or CCID.