Facts that are hidden due to privacy rules are lost when the record is updated.
1) Log in as admin
2) Set global fact privacy for SSN to "show only to admin"
3) Add a SSN record, and confirm you can view/edit it.
4) Set global fact privacy for SSN to "hide, even from admin"
5) Confirm the fact is hidden
6) Edit the record (e.g. add another fact)
7) Set fact privacy back to "show only to admin"
8) The SSN fact has now been deleted.
When privatising records, the private facts are held in a temporary cache. When the fact is edited, these private facts are supposed to be appended to the new record.
This isn't happening.