I wonder about this a bit. If I'm already storing all the PII in my database, probably on other people's computers via a managed database or at least a cloud server, why are logs different? Is it because they don't receive the same security scrutiny, e.g. any dev can view them versus having special permissions for the database?

Or is there more there than authorization that I should be thinking about?

(Obviously I'm not talking about logging cleartext passwords, which don't belong in the database either.)