The personal data itself should not be logged but the event itself should be logged with lots of details that aren't private info.