Change display for non-visible data

Hi, thanks for your help.

Was re-reading this. Are you saying if a Privacy rule says a user cannot see email it still gets brought back to the client?