Question

A privacy engineer is reviewing a new customer-facing payment application before launch. During testing, an invalid card submission returns a detailed error page that includes the full stack trace, the internal database table name, and the masked-but-partially-visible cardholder name and email that were submitted. The development team argues the verbose output is essential for troubleshooting production incidents. Applying privacy by design and privacy by default, what should the engineer recommend?

Accepted Answer

Suppress all personal data and internal system details from user-facing error responses by default, and route full diagnostic detail only to a secured, access-controlled logging system

Answer

Allow the verbose error output to remain in production but require users to accept a privacy notice before submitting the form

Answer

Keep the detailed error page but encrypt the personal data fields shown to the user so they cannot be read in transit

Answer

Retain the full error detail in production for the first 90 days after launch, then reduce verbosity once the application stabilizes