A group of CEOs urged Congress to pass national privacy legislation.

The U.K.s Information Commissioner’s Office will impose a $123M GDPR fine on Marriott as a result of newly-acquired Starwood’s data breach. For potential M&A implications, see here.

Anthem agrees to record HIPAA settlement.

Hawaii’s governor vetoed a bill that would have been the first law to prohibit the sale of a customer’s location data without consent.

A federal court in California found that customers have the right to sue Facebook over a 2016 data breach—even though the leaked information was publicly available —potentially signaling an expansion of consumers’ ability to maintain data breach class actions.

CEOs from the Business Roundtable called on Congress to pass national privacy legislation.