I thought those were the conditions that caused PII to be included in the HTML response, but the PII could come from any customer as it's a buffer overrun situation. Damn this is confusing