If your method is doing something that will be visible to the end user, security becomes a concern. You should never throw low-level exceptions back to the user on distributed systems.
Your catch() statement should encapsulate the low-level error and only write it to a (more) secure logging mechanism. One that is only easily accessible by support personnel, not to the general public.
Then, create and throw a new, generic, exception type that tells the user enough that they can intelligently report it, but doesn't give them the keys to the kingdom.
For all other exceptions, it's generally best to catch the exception at the point where it can actually be handled.
For example: If you have a business class that calls several data classes, the business class may be best suited to actually handle any data exceptions (meaning give them context in the grand scheme of things). So, don't catch in the data classes at all.
Your mileage may vary.