If a value is provided with a request to update the record, we should not nullify it. We don't send decrypted private values to the client, so if client provides it, it's probably pasted by the user.