[__david__]

With symmetric encryption, probably (assuming the data wasn't gleaned with a purely SQL injection attack). With public key/private key encryption you could probably do it more securely by not letting the private key anywhere near the main app/web servers.

Of course, the more separation you have between the public and private keys, the less convenient it is to actually do anything useful with the plaintext.