On Sept 11, 2024, in In re In re NCB Mgmt Servs., the U.S. District Court for the Eastern District of Pennsylvania dismissed a Chapter 93A claim and a putative subclass of Massachusetts residents because the “center of gravity” of the conduct giving rise to the Chapter 93A claim did not occur primarily and substantially within Massachusetts. Plaintiffs, including two Massachusetts residents, brought claims against NCB Management, a debt collection and account receivable management company, arising from a data breach and NCB’s alleged failure to adequately protect plaintiffs’ personally identifiable information (PII). 

NCB is headquartered and stored its servers in Pennsylvania and services financial institutions headquartered in South Dakota and North Carolina. The Massachusetts plaintiffs alleged that NCB violated c. 93A when it failed to implement reasonable security and privacy measures to protect PII contained in their servers. To determine if conduct occurred “primarily and substantially” in Massachusetts, the court applied the Massachusetts courts’ “center of gravity test.” Despite a fact-intensive inquiry, claims may be dismissed if plaintiffs do not allege sufficient facts connecting them to Massachusetts. Here, plaintiffs only alleged that they provided their PII to financial institutions headquartered in North Carolina and South Dakota and NCB failed to protect its servers in Pennsylvania. The only alleged Massachusetts connection was that plaintiffs suffered harm there. Such allegations were not sufficient to demonstrate a “center of gravity” of conduct occurring primarily and substantially within Massachusetts.