diff --git a/entityreference.module b/entityreference.module
index 08f5c86..c411830 100644
--- a/entityreference.module
+++ b/entityreference.module
@@ -1205,22 +1205,38 @@ function entityreference_field_formatter_view($entity_type, $entity, $field, $in
   $result = array();
   $settings = $display['settings'];
 
-  // Rebuild the items list to contain only those with access.
-  foreach ($items as $key => $item) {
-    if (empty($item['access'])) {
-      unset($items[$key]);
-    }
-  }
-
   switch ($display['type']) {
     case 'entityreference_label':
       $handler = entityreference_get_selection_handler($field, $instance, $entity_type, $entity);
 
+      // For user entities, check the current user may view user profiles.
+      // This overrides whether a link is to be displayed when checking each
+      // entity further on.
+      if ($field['settings']['target_type'] == 'user') {
+        $may_view_users = user_access('access user profiles');
+      }
+
       foreach ($items as $delta => $item) {
+        // Skip an item that is not accessible, with the exception of user
+        // target entities: a username is always visible.
+        if ($field['settings']['target_type'] != 'user' && empty($item['access'])) {
+          continue;
+        }
+
+        // Check if a link is to be displayed.
+        $uri = entity_uri($field['settings']['target_type'], $item['entity']);
+        // Display a link if the settings request it, and the entity has a uri.
+        $display_link = $display['settings']['link'] && $uri;
+        // For user entities, the user profile view check overrides the display
+        // of a link.
+        if ($field['settings']['target_type'] == 'user' && !$may_view_users) {
+          $display_link = FALSE;
+        }
+
         $label = $handler->getLabel($item['entity']);
+
         // If the link is to be displayed and the entity has a uri, display a link.
-        // Note the assignment ($url = ) here is intended to be an assignment.
-        if ($display['settings']['link'] && ($uri = entity_uri($field['settings']['target_type'], $item['entity']))) {
+        if ($display_link) {
           $result[$delta] = array('#markup' => l($label, $uri['path'], $uri['options']));
         }
         else {
@@ -1231,12 +1247,22 @@ function entityreference_field_formatter_view($entity_type, $entity, $field, $in
 
     case 'entityreference_entity_id':
       foreach ($items as $delta => $item) {
+        // Skip an item that is not accessible.
+        if (empty($item['access'])) {
+          continue;
+        }
+
         $result[$delta] = array('#markup' => check_plain($item['target_id']));
       }
       break;
 
     case 'entityreference_entity_view':
       foreach ($items as $delta => $item) {
+        // Skip an item that is not accessible.
+        if (empty($item['access'])) {
+          continue;
+        }
+
         // Protect ourselves from recursive rendering.
         static $depth = 0;
         $depth++;