A federal court in California found that customers have the right to sue Facebook over a 2016 data breach—even though the leaked information was publicly available —potentially signaling an expansion of consumers’ ability to maintain data breach class actions.

The U.K.s Information Commissioner’s Office will impose a $123M GDPR fine on Marriott as a result of newly-acquired Starwood’s data breach. For potential M&A implications, see here.

San Francisco banned the use of facial recognition by the police, and other cities may follow.

An update in Facebook’s high-stakes biometric data case.

FDA will update its medical device approval process.