The requirement that companies act in good faith is an ineffective check on CISPA power grant. It is notoriously hard to prove that a company acted in bad faith, in the few circumstances where you would actually find out your privacy had been violated.