The U.K.s Information Commissioner’s Office will impose a $123M GDPR fine on Marriott as a result of newly-acquired Starwood’s data breach. For potential M&A implications, see here.

California passed an Internet of Things cybersecurity law.

FINRA released cyber guidelines for broker-dealers.

At a recent Senate oversight hearing, the new FTC Commissioners discussed a potential federal privacy bill that could preempt state laws.

A federal court in California found that customers have the right to sue Facebook over a 2016 data breach—even though the leaked information was publicly available —potentially signaling an expansion of consumers’ ability to maintain data breach class actions.

A variety of amendments to California’s CCPA—some backed by industry, others backed by consumer groups—advanced out of committee in the Senate and Assembly.