Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:21-cv-01361 — Mary M. Rowland 1 , Judge .

ARGUED OCTOBER 22, 2024 — DECIDED AUGUST 27, 2025

Before BRENNAN, JACKSON-AKIWUMI, and KOLAR, Circuit Judges .

Page 2JACKSON-AKIWUMI, Circuit Judge . Dr. Padma Rao sued JP Morgan Chase Bank and its employee, Keifer Krause, for defamation. According to Rao, Krause told the administrator of her mother’s estate that Rao had used her power of attorney over her mother’s affairs to designate herself the payable on death beneficiary of her mother's accounts. Krause's statements, Rao maintains, led the administrator to make numerous allegations of fraud and misconduct against her in probate court. The district court dismissed several of Rao's claims, including one under the Illinois Consumer Fraud and Deceptive Business Practices Act. It then granted summary judgment to Chase and Krause on Rao’s remaining claim of defamation per se.

Rao appeals both decisions. For the reasons discussed below, we grant Rao’s unopposed motion to dismiss Krause as a party, thereby maintaining subject-matter jurisdiction over this appeal. With jurisdiction secure, we affirm the dismissal of Rao’s consumer fraud claim because Rao has not alleged that Chase gave the estate administrator unauthorized access to personal information. But we reverse the entry of judgment in favor of Chase on Rao’s defamation per se claim because Krause’s statements do not lend themselves to an innocent construction and a privilege does not apply.

On August 2012, Dr. Padma Rao's mother, Basavapunnamma Rao (B.K. Rao), went to Chase to add Rao as the payable on death (POD) beneficiary on her two personal accounts. By late 2013, B.K. Rao passed away and the probate court appointed Rao as the administrator of her mother’s estate. Five years later, in 2018, the probate court replaced Rao with Midland Trust Company.

Page 3In late 2019, the probate court ordered Rao to produce documents showing the POD designation on her mother’s Chase accounts. In the effort to comply with this order, in early 2020, Rao’s personal attorney sent Midland Trust’s attorney, Mark Singler, documents showing that two of B.K. Rao’s accounts had a POD beneficiary, but the beneficiary’s identity had been redacted.

In 2020, having received the above communication from Rao’s attorney, Midland Trust contacted Chase to determine the POD beneficiary on B.K. Rao’s accounts. Midland Trust’s Singler directed the inquiry to Keifer Krause, a private client banker with Chase. A timeline follows of Midland Trust’s initial contact with Chase; Singler and Krause's communications (all in 2020); and the lawsuit’s procedural history.

Singler’s colleague emailed Chase on February 12 requesting registration forms, beneficiary forms, beneficiary designations, and account statements for B.K. Rao's accounts. Singler’s colleague explained to Chase: “We need to determine who the named beneficiary of the accounts are [sic] and have only received a redacted screenshot of the account information....”

On March 3, Chase’s Krause met with Singler to discuss Midland Trust’s inquiry. Krause asserts that, after an initial conversation and reviewing “all available information” at the meeting, he determined the POD designations for B.K. Rao’s accounts “were established on June 11, 2013 by Padma Rao … as the agent of the Power of Attorney for Property.” At this point, Krause shared with Singler the accounts’ statements, as Page 4well as signature cards for the year 2013. After reviewing the 2013 signature cards, Singler asked Krause if these “were the documents establishing the POD Beneficiary Designation” for the accounts. Krause confirmed that they were.

On March 16, Singler filed a report in probate court. Singler’s report stated that Rao had used her agency as Power of Attorney (POA) to name herself as the POD beneficiary of B.K. Rao’s accounts. Under Illinois law, it would have been illegal for Rao to give herself this designation. See Garner v. Garner , 2022 IL App (3d) 200142-U, ¶ 21 (“One who holds a power of attorney is a fiduciary as a matter of law.”); 720 ILCS 5/17-56 (prohibiting the misappropriation of assets by breach of a fiduciary duty); see also People v. Bailey , 948 N.E.2d 690, 695-96 (Ill. App. Ct. 2011) (affirming financial exploitation conviction where the defendant used her POA to deplete an elderly and disabled person’s life savings). So, Singler further accused Rao of committing a “purposeful, self-serving, fraudulent … breach of her fiduciary duty.”

On April 16, Singler followed up with Krause via email. First, Singler indicated to Krause that Rao believed the POD designation “was established in 2009 when the account was established, not in 2013.” Singler then requested copies of the 2009 account registration forms. In turn, Krause reviewed the 2009 forms but found that these “did not establish a POD Beneficiary.' Once more, Krause affirmed that 'the documents establishing the POD Beneficiary Designations” were the 2013 signature cards.

Page 5That same day, Singler and Krause met for a second time. At this meeting, Krause provided Singler the accounts’ 2009 signature cards. After reviewing the 2009 cards, Singler asked Krause if there were “any other documents establishing the POD Beneficiary Designation[s].' Yet again, Krause confirmed that he “believed the 2013 [signature cards] were the documents establishing the POD Beneficiary Designations with the use of the [POA].”

On April 17 and then again on April 20, Rao’s attorney, Michael Steigmann, emailed Singler, noting his disagreement with Singler’s conclusion that the 2013 signature cards proved the POD designation. He also wrote that “no one at Chase” had told Singler that the 2013 signature cards showed that the POD designation had been made the same day the cards were signed. Finally, Steigmann requested the names and contact information of the people Singler had spoken to at Chase.

On April 23, Rao reached out to Chase herself. As she explains it, employees familiar with her confirmed that someone with POA could never designate herself as a POD beneficiary. This was bank policy. The employees, Rao maintains, provided her with documents to defend herself—the 2012 signature cards her mother had executed. Rao recounted her conversations with the Chase employees in an affidavit.

Also on April 23, Krause and Singler met for a third time, with Singler requesting that Krause review all documents establishing the POD beneficiary designations for the accounts. At last, Krause reviewed the signature cards B.K. Rao executed on August 1, 2012, when she added Rao as POD beneficiary. Krause explained, in his affidavit, that during his first and second meetings with Singler he had believed “that the only documents establishing the POD Beneficiary Designations for [the accounts] were the 2013 [signature cards].” And it was not until the third meeting, when Singler requested that he review “each and every document,” that he discovered the 2012 signature cards. According to Krause, the 2012 cards “were for some reason not readily available” during his prior reviews.

In 2021, Rao filed a lawsuit in Illinois state court naming Chase and Krause as defendants. Rao asserted against all defendants 2 claims of defamation, false light invasion of privacy, and public disclosure invasion of privacy. Against Chase, she also asserted a violation of the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505/1, for violating the Personal Information Protection Act, 815 Ill. Comp. Stat. 530/1. Before Rao served any defendant, Chase removed the case to federal court, despite Rao and Krause sharing Illinois citizenship.

Page 7The district court dismissed all of Rao’s claims, except for her defamation per se claim. Defendants then moved for summary judgment on that remaining claim. The court granted Defendants’ motion, concluding that: (1) Rao had not shown “by a preponderance of the evidence” that Defendants made false and defamatory statements and (2) even if they did, their statements enjoyed an innocent construction and were protected by qualified privilege. Rao appeals both the dismissal of her claim and the grant of summary judgment to Defendants.

We first address whether we can exercise jurisdiction over this matter.

“As a court of limited jurisdiction, we have an obligation to ensure that a case is properly in federal court before reaching the merits.” Page v. Alliant Credit Union , 52 F.4th 340, 345 (7th Cir. 2022). An action removable solely on the basis of diversity may not be removed “if any of the parties in interest properly joined and served as defendants is a citizen of the State in which such action is brought.” 28 U.S.C. § 1441(b)(2). This is known as the forum defendant rule. Morris v. Nuzzo , 718 F.3d 660, 665 (7th Cir. 2013). In some jurisdictions, defendants may overcome the forum defendant rule by removing a case before in-forum defendants are properly joined and served. M & B Oil, Inc. v. Federated Mut. Ins. Co. , 66 F.4th 1106, 1107 (8th Cir. 2023) (explaining the practice). This is known as snap removal.³ Id.

Page 8Before Rao served any defendants, Chase snap-removed the case to federal court. In doing so, Chase circumvented the forum defendant rule, since Krause, not yet served, would be an in-forum defendant. Now in federal court, the parties lacked complete diversity based on Rao and Krause’s citizenship (both Illinois). See 28 U.S.C. § 1332 (“The district courts shall have original jurisdiction of all civil actions where the matter in controversy exceeds the sum or value of $75,000, exclusive of interest and costs, and is between—(1) citizens of different States ....”).

On appeal, the parties initially maintained that jurisdiction was proper because jurisdiction, they argued, is determined at the time of removal, and nothing filed after removal affects it. After reviewing the parties' jurisdictional statements, this court ordered supplemental briefing to address whether subject-matter jurisdiction existed. In supplemental briefing, Defendants reversed their position, conceding that diversity is determined based on citizenship at the time the suit is filed, rather than the time of service. See Newman-Green, Inc. v. Alfonzo-Larrain , 490 U.S. 826, 830 (1989) (“The existence of federal jurisdiction ordinarily depends on the facts as they exist when the complaint is filed.'); Howell ex rel. Goerdt v. Trib. Ent. Co. , 106 F.3d 215, 217 (7th Cir. 1997) (“[I]n the federal judicial system a party becomes a defendant not when he is served but when the complaint naming him is filed.').

Page 9Defendants also argued for the first time on appeal that an exception to complete diversity applies because, in their view, Rao fraudulently joined Krause. Separately, Rao filed a motion to dismiss Krause, which Defendants do not oppose.

Although it is concerning that the issue of incomplete diversity was not raised until appeal, we have the authority to retain jurisdiction over the remaining claim against Chase by dismissing Krause. See Howell by Goerdt , 106 F.3d at 218 (holding appellate courts can 'restore complete diversity, even when the case is on appeal and diversity was incomplete in the district court, by dropping a party whose presence is unnecessary to the proper resolution of the controversy”). We recognize 'such authority should be exercised sparingly.' Newman-Green , 490 U.S. at 837. But because no harm would come to the parties from the dismissal of Krause, Defendants do not oppose the dismissal, and the practicalities of having to relitigate “weigh heavily in favor” of retaining jurisdiction, we grant Rao’s motion to dismiss Krause from this suit. See id. at 837–88. As such, we do not reach the Defendants’ assertion of fraudulent joinder.

We review de novo the district court’s grant of summary judgment, viewing the record in the light most favorable to Rao as the non-moving party. Glob. Relief Found., Inc. v. N.Y. Times Co. , 390 F.3d 973, 981 (7th Cir. 2004). We apply the substantive law of Illinois, the state where Rao filed her defamation suit. Id. (“[A] district court sitting in diversity must apply the law of the state in which it sits.” (citing Allstate Ins. Co. v. Menards, Inc. , 285 F.3d 630, 634 (7th Cir. 2004)).

Page 10A defamatory statement is a statement which 'tends to harm a person’s reputation to the extent that it lowers that person in the eyes of the community or deters others from associating with that person.” Tuite v. Corbitt , 866 N.E. 2d 114, 121 (Ill. 2006) (citations omitted). “A statement is defamatory per se if its defamatory character is obvious and apparent on its face and injury to the plaintiff’s reputation may be presumed.” Id. For example, a statement imputing the commission of a crime is a type of defamatory per se statement. Id. Defamatory per se statements, however, are not actionable if they are reasonably capable of an innocent construction or privileged. Id. (innocent construction rule); Solaia Tech., LLC v. Specialty Pub. Co. , 852 N.E. 2d 825, 842 (Ill. 2006) (absolute and qualified privilege).

The district court determined that Krause did not make any defamatory statements at all, and that, even if Krause did, those statements could be innocently construed and were protected by a qualified privileged. Rao argues all of this was error, and Defendants’ motion for summary judgment should have been denied. We agree with Rao.

Before turning to Rao’s arguments, we address the nature of the record. The primary record evidence is from Krause’s responses to interrogatories and Krause’s affidavit, which detail his conversations with Singler.⁴ Chase does not dispute that the meetings and communications took place. Rather, Chase takes issue with Rao’s decision not to depose any witnesses. Although it is true that Rao could have pursued Page 11additional discovery to present a more robust record, depositions are an optional, not mandatory, discovery tool. See Fed. R. Civ. P. 30(a)(1) (“A party may , by oral questions, depose any person, including a party, without leave of court....'). And Krause’s affidavit offers sufficient detail to evaluate his statements.

Before reaching the question of whether the innocent construction rule renders Krause’s statements non-actionable, we address a preliminary argument by Rao. Rao argues that Judge Rowland contravened the law of the case by deciding at summary judgment that Krause’s statements were capable of an innocent construction despite the fact that Judge Lee held the innocent construction defense was inapplicable when deciding Defendants' motion to dismiss. We do not read Judge Lee’s decision as creating a law of the case such that Judge Rowland could not reevaluate an innocent construction defense at summary judgment after the parties developed the evidentiary record.

Under the law of the case doctrine, judges should not reopen 'issues decided in earlier stages of the case absent extraordinary circumstances.” Galvan v. Norberg , 678 F.3d 581, 587 (7th Cir. 2012). This doctrine “is discretionary and does not preclude a district court from reopening a decided issue.” Id. Where two judges preside over the same case, 'the second judge should ‘abide by the rulings of the first judge unless some new development, such as a new appellate decision, convinces him that his predecessor’s ruling was incorrect.’” Id. (citations omitted). The second judge may also determine that the doctrine applies with less force if, for example, the prior order was interlocutory, and this is the first instance the Page 12parties present adversarial positions. Id. ; Cameo Convalescent Ctr., Inc. v. Percy , 800 F.2d 108, 110 (7th Cir. 1986) ('Prejudgment orders, such as motions to dismiss, are interlocutory and may be reconsidered at any time.”).

Judge Lee’s opinion took Rao’s allegations as true, which is necessary at the dismissal stage, and denied the innocent construction defense as grounds for dismissal without foreclosing any future assertion of the defense. His opinion states: “ taking all facts in Dr. Rao's favor , Krause's 'understanding' was that Dr. Rao had designated herself as POD beneficiary while acting as BK Rao’s agent—which is indictable as fraud and criminal exploitation.... Thus, the innocent construction rule is inapplicable here.” Rao v. JPMorgan Chase Bank, N.A. , No. 21 C 1361, 2022 WL 847560, at *4 (N.D. Ill. Mar. 22, 2022) (emphasis added) (internal citations omitted). Chase did not reassert the innocent construction argument at summary judgment. Still, Judge Rowland was permitted to reach a different conclusion about Krause's statements because Judge Lee’s denial of the motion to dismiss was interlocutory and Judge Rowland had the added benefit of a fuller evidentiary record (relevant here, Krause’s affidavit). See Galvan , 678 F.3d at 587 (7th Cir. 2012) (“[T]he law of the case doctrine applies with less force in this case since the prior order was interlocutory and since a 'new development' occurred: defendants had not been given the opportunity to respond to the initial new trial ruling....'); see also Brengettcy v. Horton , 423 F.3d 674, 677, 680–81 (7th Cir. 2005) (assessing whether “new material” presented on summary judgment provided a 'compelling reason” for a second judge to revisit an earlier judge’s exhaustion ruling at the dismissal stage). With that, we turn to the rule’s application.

Page 13The innocent construction rule applies when a defamatory statement “may reasonably be innocently interpreted.” Tuite, 866 N.E.2d at 122 (emphasis removed) (citing Chapski v. Copley Press , 442 N.E. 2d 195 (Ill. 1982)). “This preliminary determination is a question of law to be resolved by the court….” Id. If there is no innocent construction, the remaining question for the jury is “whether the statement was in fact understood to be defamatory.' Id. In making a reasonable construction determination in the first instance, a court “must give the allegedly defamatory words their natural and obvious meaning” and interpret them “as they appeared to have been used and according to the idea they were intended to convey to the reasonable reader.'⁵ Id. at 123 (quoting Bryson v. News Am. Publ'ns, Inc. , 672 N.E.2d 1207, 1217 (1996)). Finally, “if a statement is capable of two reasonable constructions, one defamatory and one innocent, the innocent one will prevail.' Muzikowski v. Paramount Pictures Corp. , 477 F.3d 899, 904 (7th Cir. 2007) (citation omitted).

Krause’s statements do not lend themselves to an innocent construction. To understand the import and effect of Krause’s statements, we go back to the initial request he received from Midland Trust on February 12, 2020. Recall, on this date, a Midland Trust attorney communicated to Krause the administrator's end goal of ascertaining 'who the named beneficiary” was on B.K. Rao’s accounts. The attorney did not confine this request to any year. And yet, during his first meeting Page 14with Singler, Krause asserted that the POD beneficiary for the accounts 'w[as] established on June 11, 2013 by Padma Rao (“Padma”) as the agent of the [POA] .” During his second meeting, Krause once more stated that the 2013 signature cards “were the documents establishing the POD Beneficiary Designations with the use of the [POA] .” The natural reading of this is that Krause told Singler that Rao “as the agent of” or “with the use of” the POA established the POD beneficiary designation.

Chase tries to walk back Krause’s statements by arguing that the word “establish[]” really meant “to show” rather than “to set up.” But this is not a natural, reasonable reading of Krause’s statements. For one, it is inconsistent with the way Krause explained his use of the term in his own affidavit. For example, on April 16, Singler explained to Krause that Rao was alleging the POD designations “were not established in 2013, but rather established in 2009.' Krause's response that day was that the 2013 signature cards were “the documents establishing the POD Beneficiary Designations with the use of the [POA].” If by “establishing,” Krause merely meant to denote that the 2013 signature cards were “showing” this designation, then it would be nonsensical to append to his explanation the phrase “with the use of the [POA].” Rao could not use her POA to show the POD beneficiary designation.

Krause’s interpretation of his own statements, even under oath, cannot by itself form the basis of an innocent construction. The court must interpret the statement from the perspective of how the words “appeared to have been used” as well as “according to the idea they were intended to convey to the reasonable reader.” Tuite, 866 N.E.2d at 123. The only natural, reasonable reading of what Krause conveyed to Singler is that Page 15Rao, using her POA, designated herself as POD beneficiary. Because Chase does not offer an alternative reasonable interpretation of Krause’s statements, it cannot prevail under the innocent construction rule.

A defamatory statement is also not actionable if it is subject to a qualified privilege. Solaia Tech., LLC , 852 N.E. 2d at 842 (referring to the privilege interchangeably as qualified or conditional). A qualified privilege 'is based on a policy of protecting honest communications of misinformation in certain favored circumstances in order to facilitate the availability of correct information.' Dent v. Constellation NewEnergy, Inc. , 2022 IL 126795, ¶ 30, reh’g denied (Sept. 26, 2022) (citing Kuwik v. Starmark Star Mktg. & Admin., Inc. , 619 N.E. 2d 129 (Ill. 1993)). This privilege can exist “as a matter of law where the following elements are present: (1) good faith by the defendant in making the statement; (2) an interest or duty to uphold; (3) a statement limited in its scope to that purpose; (4) a proper occasion; and (5) publication in a proper manner and to proper parties only.” Kuwik , 619 N.E. 2d at 133.

A plaintiff may overcome a defendant’s assertion of qualified privilege by proving abuse. Kuwik , 619 N.E. 2d at 135. To prove abuse, “the plaintiff must show a direct intention to injure another, or a reckless disregard of [the defamed party’s] rights and of the consequences that may result to [her].” Id. (citation modified) (citations omitted). Reckless disregard of the defamed party's rights may include 'the failure to properly investigate the truth of the matter, limit the scope of the material, or send the material to only the proper parties.” Id. at 136. Although the abuse determination is generally a question for the fact finder, summary judgment is still Page 16available where there is no genuine issue as to any material fact—even for a defendant who asserts the privilege and a plaintiff who asserts abuse of privilege in response. Cf. id.

Rao does not contest that qualified privilege covers the communications Krause was having with Singler. Rather, she maintains the district court improperly excluded as hearsay her affidavit, which demonstrated genuine issues of material fact about Krause's abuse of that privilege. We agree with Rao’s position.

'We review a district court's decision that a particular hearsay statement is not admissible under an abuse of discretion standard.” Schindler v. Seiler , 474 F.3d 1008, 1010 (7th Cir. 2007). Statements made out of court and being offered for their truth are considered hearsay. Fed. R. Evid. 801(c). To be admissible, Rao must show “that an exception to the hearsay rule applies or that the statements are not hearsay.' Makowski v. SmithAmundsen LLC , 662 F.3d 818, 822 (7th Cir. 2011) (citing Fed. R. Evid. 801(d), 803). A statement is not hearsay if it “is offered against an opposing party' and 'was made by the party’s agent or employee on a matter within the scope of that relationship and while it existed.” Fed. R. Evid. 801(d)(2)(D).

Rao filed an affidavit at summary judgment recounting conversations she had with several Chase employees, including Donna Galvan, Gideon Berger, and Nihila Sivarajan. According to Rao, she had previously met with these employees at Chase over the years. After Singler’s probate report, Rao notified Galvan of the accusations against her in probate court based on the 2013 signature cards. As Rao explains in her affidavit, Galvan replied that “under Chase Bank policies for establishing a POD designation, a POA Agent could never use that agency to establish a new POD designation because the Page 17POD designation must be made directly and personally by the account holder.” Galvan then reviewed B.K. Rao’s account and found the 2012 signature cards showing the beneficiary designation. To help Rao defend herself against the accusations, Berger provided her with a copy of the 2012 signature cards. In a separate conversation, Sivarajan conveyed the same bank policy as Galvan and that the 2012 signature cards showed the POD designation made by B.K. Rao. The district court excluded Rao’s affidavit on the basis that it contained inadmissible double hearsay.

Rao contends that the Chase employees’ statements she offers are not hearsay, but rather party opponent admissions. For support, Rao cites our decision in Makowski . There, a plaintiff asserting employment discrimination sought to introduce statements the human resources director made to her concerning her termination. 662 F.3d at 822. This Court found the statements were admissions of a party opponent, and thus, admissible as nonhearsay. Id. at 822-23 ('Involvement in the process leading up to the employment action at issue is enough to make an employee’s statement an admission.” (citing Simple v. Walgreen Co. , 511 F.3d 668, 672 (7th Cir.2007)).

Chase responds that Galvan and Sivarajan's statements are inadmissible as to Krause because Galvan and Sivarajan were Chase’s, not Krause’s, employees. But because Krause is no longer a defendant in this case, we need not address this argument. Separately, Chase contends that the district court properly excluded Rao's affidavit because although statements by a supervisor are nonhearsay admissions, the same exception does not apply to a plaintiff’s version of the statements which are, in turn, based on another employee's Page 18version of the statements. Chase relies on two cases for support, which we address below.

In Haywood v. Lucent Techs., Inc. , the plaintiff alleged that her former managers had told the security guard that she was unstable and to call the police if she appeared on the premises. 323 F.3d 524, 533 (7th Cir. 2003), overruled on other grounds by Ortiz v. Werner Enterprises, Inc. , 834 F.3d 760 (7th Cir. 2016). The plaintiff learned about these statements from a security guard; the guard, in turn, had learned about the statements from the plaintiff's superiors. Id. Our court concluded that the statements were inadmissible hearsay because the plaintiff’s own version of the statements was 'based on another employee’s version of the statements, which [was] based on the employees’ superiors’ version of the statements.” Id.

In Schindler v. Seiler , the plaintiff alleged an individual and his employer defamed the plaintiff by telling a third party that he was a bad doctor who had paralyzed four patients. 474 F.3d 1008, 1009 (7th Cir. 2007). We found these statements constituted hearsay because the plaintiff 'failed to present testimony from any individual who personally heard [the individual] make the defamatory statements.” Id. at 1011. Instead, the plaintiff’s testimony was “offered precisely to prove the ultimate fact in question and the truth of the matter asserted therein.” Id.

Here, unlike in Schindler , Rao’s affidavit does not offer the Chase employees' statements as versions of what Krause said—the ultimate question in her defamation per se claim. And unlike the plaintiff in Haywood , she does not rely on a chain of employees who heard the statements from yet other employees. Instead, Rao offers Galvan and Sivarajan’s statements as proof that Krause behaved recklessly based on the Page 19avenues of inquiry and documents available to him. This mirrors the nonhearsay application in Makowski . That is, employees whose job duties related to Krause’s duties at Chase and who were involved with Rao’s situation could ascertain the correct POD designation information based on bank policy and the information available—and Krause could have too. See Makowski , 662 F.3d at 822–23. Thus, the employees’ statements recounted in Rao's affidavit are nonhearsay admissions of a party opponent. Rao’s affidavit was admissible.

This takes us to the next question: whether Rao’s affidavit presents genuine issues about whether Krause abused his qualified privilege. We find that it does. As Rao points out, her affidavit presents evidence from which a reasonable jury could find that Krause’s investigation of the POD designation was reckless. A reasonable jury could infer that Krause should have known Chase’s policy which prevented the use of a POA to designate a POD beneficiary on an account. At the same time, a reasonable juror could conclude that Krause could have located the 2012 signature cards through a reasonable search, just like his colleagues did in response to Rao's inquiry. The 2012 cards, recall, showed that B.K. Rao made the POD designation herself. Alternatively, a reasonable jury could find that, having reviewed even just the 2013 signature cards, Krause should have seen that Galvan issued the cards and consulted her about the situation.

Evidence of Chase’s policy, the substance of which Chase does not contest, and the availability of the correct documents showing the POD designation create genuine, material issues of fact as to Krause’s recklessness. This means the case was not suitable for summary judgment based on qualified privilege. Cf. Kuwik , 619 N.E. 2d at 136.

Chase argues that it cannot be liable because even Rao’s own attorney (Steigmann), as Chase tells it, admitted that “no one at Chase” gave Singler the information he ultimately used in his probate report. Indeed, in response to Singler’s assertion that his report relied on “reliable information and documentation directly from [Chase],” Steigmann said “no one at Chase” told Singler that the 2013 signature cards showed the POD designation was made on the same day that the cards were signed. But Steigmann’s comment is not dispositive. For one, it is unclear if, at the time of Steigmann’s comment, he or Rao knew about Krause’s conversations with Singler. It is possible they did not given their demand, in that same communication where Steigmann made the 'no one at Chase' remark, that Singler disclose the 'names and contact information” of the people at Chase with whom Singler had spoken. Singler later identified Krause in a supplemental probate report, writing that he had “reasonably relied upon” Krause as a “trusted representative of Chase.” But that report was not filed until July 1, 2020. What's more, regardless of Steigmann’s remark, Krause admitted to telling Singler that Rao used her POA to designate herself the POD beneficiary (Krause resists this interpretation but, as discussed above, this is the only natural, reasonable reading of his statements).

Because we conclude there is no innocent construction or qualified privilege applicable to Krause’s statements, a jury must determine “whether the statement was in fact understood to be defamatory or to refer to the plaintiff.” Tuite , 866 N.E.2d 114 at 122.

Page 21Rao's claim that Chase violated the Illinois Consumer Fraud Act by, in turn, violating the Personal Information Protection Act meets a different fate on appeal.⁶ The district court granted Chase’s motion to dismiss this claim. We review that decision de novo, “considering [Rao’s] arguments as to the sufficiency of [her] complaint anew.' Brockett v. Effingham Cnty. , 116 F.4th 680, 685 (7th Cir. 2024). We conclude the district court’s dismissal of this claim was proper.

Rao's claim involves two laws. First is the Illinois Consumer Fraud Act (ICFA). “ICFA protects consumers against unfair or deceptive acts or practices, including fraud, false promise, and the misrepresentation or the concealment, suppression or omission of any material fact.' Wigod v. Wells Fargo Bank, N.A. , 673 F.3d 547, 574 (7th Cir. 2012) (internal quotations omitted) (citing 815 ILCS 505/2). The elements of an ICFA claim are: “(1) a deceptive or unfair act or practice by the defendant; (2) the defendant’s intent that the plaintiff rely on the deceptive or unfair practice; and (3) the unfair or deceptive practice occurred during a course of conduct involving trade or commerce.” Id. A plaintiff must also prove that Page 22the defendant’s conduct is the proximate cause of her injury. Id.

Second is the Personal Information Protection Act (PIPA). Under PIPA:

A data collector that owns or licenses, or maintains or stores but does not own or license, records that contain personal information concerning an Illinois resident shall implement and maintain reasonable security measures to protect those records from unauthorized access , acquisition, destruction, use, modification, or disclosure.

815 ILCS 530/45(a) (emphasis added). Personal information can include an individual's name, unredacted and unencrypted, in combination with their social security number, driver’s license, financial account number, among other identifying information. 815 ILCS 530/5(1). “A violation of [PIPA] constitutes an unlawful practice under [ICFA].' 815 ILCS 530/20.

In her complaint, Rao alleged that Chase violated ICFA by engaging in the unlawful practice of providing unauthorized access or disclosure in violation of PIPA. As Rao explains it, Chase provided Midland Trust unauthorized access to unredacted versions of the 2013 signature cards, which contained her driver’s license number, social security number, birthday, Visa card number, and home address. As a result, her personal identity information was extensively disclosed in court filings. In turn, this made her vulnerable to fraud.

Rao fails to 'state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). As the district court pointed Page 23out, PIPA includes a good-faith exception when data collectors access personal information for legitimate purposes. Cf. 815 ILCS 530/5 ('Breach of the security of the system data does not include good faith acquisition of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector, provided that the personal information is not used for a purpose unrelated to the data collector's business or subject to further unauthorized disclosure.” (citation modified)). Rao takes issue with Chase’s disclosure of her information, but she does not cite any authority stating that estate administrators cannot obtain the documents Chase provided Singler to ascertain a beneficiary. In other words, Rao does not allege or argue that Midland Trust obtained the documents for an illegitimate purpose. Rao seems to argue that, because she was already a POD beneficiary on the accounts, Midland Trust could no longer investigate the accounts—it sufficed for Chase to inform Midland Trust that there was indeed a valid POD beneficiary, and nothing more. But that is not how estate administration works. One of an administrator’s legitimate purposes is to ascertain who beneficiaries are, as part of the probate court’s settling of an estate. See In re Est. of Denten , 2012 IL App (2d) 110814, ¶ 42 (“The administration of an estate in the probate court is not an action between or among parties, but is in the nature of a proceeding in rem , acting directly on the res, which is the estate of the deceased or the disabled person, and the judgment of the probate court settling the estate is a judgment in rem.”). Even if Midland Trust should not have later disclosed the unredacted signature cards containing Rao’s personal information in probate court, that is a separate issue not before this Court.

Thus, Rao’s allegations under ICFA cannot survive.

Page 24We AFFIRM the dismissal of Rao’s ICFA claim because she has not alleged that Chase’s disclosures to Singler, as administrator of B.K. Rao’s estate, precipitated unauthorized access to information under PIPA.

On the other hand, Chase has not established an innocent construction for Krause’s statements to Singler about Rao, or that Krause's statements were privileged. We therefore REVERSE the district court’s grant of summary judgment to Chase. This case must go before a jury to determine whether Krause’s statements were understood to be defamatory. Tuite , 866 N.E.2d at 122 (“[W]hether the statement was in fact understood to be defamatory or to refer to the plaintiff is a question for the jury….”).

We remand the case for further proceedings consistent with this opinion. In doing so, we decline Rao’s request for a new judge on remand. Seventh Cir. Rule 36.

AFFIRMED IN PART;

REVERSED AND REMANDED IN PART.