There is immunity for sharing information "in good faith" under CISPA. CISPA is not a blanket authorization to share data.
If an ISP suffers a breach and coughs up huge amounts of PII that they handled negligently, they are absolutely still liable after CISPA becomes a law.