Prohibiting a merchant from sharing or selling specified personal and marketing information about specified consumers; establishing an exception; etc.