Resident PII sometimes appears in custom log dimensions. What balance should the city strike?
Select an answer to reveal the explanation.
Short Explanation
Redact the PII, keep the breadcrumbs—like blacking out names on a published agenda while leaving the agenda numbers.
Full Explanation
When resident PII sometimes appears in custom log dimensions, the city should redact resident PII from those dimensions while retaining operationally useful trace fields. Status codes, operation names, dependency targets, latency, and correlation IDs usually suffice for diagnosing civic AI issues; Social Security numbers, home addresses, and similar identifiers do not belong in broadly queryable telemetry. Redaction balances privacy, compliance, and operability.
Logging full SSN and home address in every span attribute for easier support maximizes breach impact and likely violates municipal privacy policy. Disabling all application logging so no operational signals remain makes outages untriageable and is an overreaction. Publishing raw traces to a public Power BI tile for transparency can expose PII beyond authorized staff.
Exam caveat: Redaction should happen at instrumentation time (or via enforced processors) because once PII is ingested into Log Analytics it may be retained and queried under many roles. Distinguish secrets/PII from operational identifiers. Some regulated workloads need formal data classification and retention alignment—not only ad hoc string scrubbing.
Operational check: Inventory custom dimensions on resident-facing AI services, remove or hash/redact PII fields, deploy processors that drop forbidden attributes, sample production traces to verify cleanliness, and keep RBAC tight on workspaces as a second control. Add a CI or review checklist that rejects new span attributes containing raw resident identifiers.