diff --git a/profile2.module b/profile2.module
index 7ae9240..b63a54a 100644
--- a/profile2.module
+++ b/profile2.module
@@ -319,13 +319,15 @@ function profile2_profile2_type_delete($type) {
  */
 function profile2_user_view($account) {
   foreach (profile2_get_types() as $type => $profile_type) {
-    if ($profile_type->userView && ($profile = profile2_load_by_user($account, $type))) {
-      $account->content['profile_' . $type] = array(
-        '#type' => 'user_profile_category',
-        '#title' => $profile->label,
-        '#prefix' => '<a id="profile-' . $profile->type . '"></a>',
-      );
-      $account->content['profile_' . $type]['view'] = $profile->view('account');
+    if ($profile_type->userView && $profile = profile2_load_by_user($account, $type)) {
+      if (profile2_access('view', $profile)) {
+        $account->content['profile_' . $type] = array(
+          '#type' => 'user_profile_category',
+          '#title' => $profile->label,
+          '#prefix' => '<a id="profile-' . $profile->type . '"></a>',
+        );
+        $account->content['profile_' . $type]['view'] = $profile->view('account');
+      }
     }
   }
 }
diff --git a/profile2.test b/profile2.test
index 888b4e3..5f1b51c 100644
--- a/profile2.test
+++ b/profile2.test
@@ -115,10 +115,16 @@ class ProfileCRUDTestCase extends DrupalWebTestCase {
     $this->drupalGet('user/' . $user1->uid . '/edit/main');
     $this->assertText(t('Access denied'), 'Access has been denied.');
 
+    // Test creating a profile manually (e.g. by an admin) and ensure the user
+    // may not see it.
+    profile_create(array('type' => 'main', 'uid' => $user1->uid))->save();
+    $this->drupalGet('user/' . $user1->uid);
+    $this->assertNoText(t('Main profile'), 'Profile data is not visible to the owner.');
+
     $user2 = $this->drupalCreateUser(array('edit own main profile', 'view own main profile'));
     $this->drupalLogin($user2);
 
-    // Create profiles for the user1.
+    // Create profiles for the user2.
     $edit['profile_main[profile_fullname][und][0][value]'] = $this->randomName();
     $this->drupalPost('user/' . $user2->uid . '/edit/main', $edit, t('Save'));
     $this->assertText(t('The changes have been saved.'), 'Profile saved.');