How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only personnel with a legitimate business need can see the full PAN. 10.2.1 Log all individual user accesses to cardholder data
To be more specific, application search screen (based on users search) lists multiple results in table format where among others is PAN, cardholder name, merchant ID etc. We always mask PAN on such result table and if user has business need to see the PAN, he/she can click on the masked PAN in order to see full PAN. This click triggers logging mechanism and we can see which user accessed certain PAN (therefore, complying with PCI DSS req 10.2.1). Of course, we get complaints from users, that this is not user friendly because they cannot immediately identify PAN which they require.
My questions would be - what would be your approach to this? Any suggestions to improve?