Two Less Exciting Points From The TJX Identity Theft Case

The First Circuit handed down an opinion in connection with the TJX identity theft debacle from a few years ago. The case is In re: TJX Retail Security Breach Litigation, No. 08-2828. Everyone probably remembers the facts, but here's a link to a contemporaneous news account. If you're looking for sexy talk about identity theft, though, you ought to move along.

Now: If you're an attorney and your practice rubs up against commercial litigation, you should skip to page 14 of the opinion. There you'll find a couple of important statements by the First Circuit concerning Chapter 93A, the unfair business practices statute. First, the Court makes it clear that 93A claims need not be based on "egregious" conduct. But the Court doesn't go very far in clarifying what types of unfair conduct do manage to clear the statutory hurdle. "[S]ystematic recklessness may suffice." Might it? Hmm.

Second, the Court discusses the requirement that the unfair act(s) in question must happen primarily and substantially in the Commonwealth. Here we get a bit more clarification, but only a bit. Apparently the requirement is satisfied if a defendant has an office in Massachusetts -- even if the bad acts didn't happen at that office. Communicating with someone via servers located in Massachusetts also seems to get you there. That's good to know, too. Is it entirely consistent with the statute's language? Again: hmm.