On April 12, 2011, United States Senators John Kerry and John McCain formally proposed the Kerry-McCain Commercial Privacy Bill of Rights Act of 2011 ("CPBRA"). This proposed legislation would apply to all retailers, including those in the fashion, beauty, and apparel industries, that request and record their customers' personal information. If passed in its current form, the CPBRA would preempt similar state laws, would not provide a private right of action upon which an individual claim could be based, and would cap penalties at $3 million. While that is good news in light of the burgeoning class action privacy-related litigation filed against companies by private plaintiffs under state consumer protection laws, compliance with the CPBRA could potentially be onerous because the CPBRA replaces industry self-regulation with government regulation.

Below are some of the highlights of the proposed CPBRA, in its current form:

- The CPBRA will apply to "covered information", which includes: "personally identifiable information" ("PII"), "unique identifier information", and any information that is collected, used, or stored in connection with the two former categories of information in a manner that may reasonably be used to identify a specific individual. [CPBRA Sect. 3(3)(A)].

- "Covered information" does not include PII from public records not merged with "covered information" gathered elsewhere, PII obtained from a forum where the information was voluntarily shared and is widely and publicly available (think Facebook), PII reported in the public media, or PII dedicated to contacting an individual at work....