diff --git a/src/Controller/EntityResource.php b/src/Controller/EntityResource.php
index 363a622..69431f1 100644
--- a/src/Controller/EntityResource.php
+++ b/src/Controller/EntityResource.php
@@ -27,6 +27,7 @@ use Drupal\jsonapi\Context\CurrentContext;
 use Drupal\jsonapi\ResourceResponse;
 use Drupal\jsonapi\Routing\Param\JsonApiParamBase;
 use Drupal\jsonapi\Routing\Param\OffsetPage;
+use Drupal\user\Entity\User;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -118,8 +119,17 @@ class EntityResource {
    */
   public function getIndividual(EntityInterface $entity, Request $request, $response_code = 200) {
     $entity_access = $entity->access('view', NULL, TRUE);
-    if (!$entity_access->isAllowed()) {
-      throw new EntityAccessDeniedHttpException($entity, $entity_access, '/data', 'The current user is not allowed to GET the selected resource.');
+    if (!$entity_access->isAllowed() && $entity instanceof User) {
+      $entity_access = $entity->access('view label', NULL, TRUE);
+      if (!$entity_access->isAllowed()) {
+        throw new EntityAccessDeniedHttpException($entity, $entity_access, '/data', 'The current user is not allowed to GET the selected resource.');
+      }
+
+      // Build a substitute entity that only holds the label.
+      $entity = User::create([
+        'name' => $entity->getDisplayName(),
+        'uuid' => $entity->uuid(),
+      ]);
     }
     $response = $this->buildWrappedResponse($entity, $response_code);
     return $response;
@@ -724,6 +734,16 @@ class EntityResource {
     $entity_repository = \Drupal::service('entity.repository');
     $entity = $entity_repository->getTranslationFromContext($entity, NULL, ['operation' => 'entity_upcast']);
     $access = $entity->access('view', NULL, TRUE);
+    if (!$access->isAllowed() && $entity instanceof User) {
+      $access = $entity->access('view label', NULL, TRUE);
+      if ($access->isAllowed()) {
+        // Build a substitute entity that only holds the label.
+        $entity = User::create([
+          'name' => $entity->getDisplayName(),
+          'uuid' => $entity->uuid(),
+        ]);
+      }
+    }
     // Accumulate the cacheability metadata for the access.
     $output = [
       'access' => $access,
diff --git a/src/Normalizer/Value/EntityNormalizerValue.php b/src/Normalizer/Value/EntityNormalizerValue.php
index b30a79b..ff97f38 100644
--- a/src/Normalizer/Value/EntityNormalizerValue.php
+++ b/src/Normalizer/Value/EntityNormalizerValue.php
@@ -5,6 +5,7 @@ namespace Drupal\jsonapi\Normalizer\Value;
 use Drupal\Core\Cache\RefinableCacheableDependencyInterface;
 use Drupal\Core\Cache\RefinableCacheableDependencyTrait;
 use Drupal\Core\Entity\EntityInterface;
+use Drupal\user\Entity\User;
 
 /**
  * @internal
@@ -68,6 +69,12 @@ class EntityNormalizerValue implements ValueExtractorInterface, RefinableCacheab
     $this->context = $context;
     $this->entity = $entity;
     $this->linkManager = $link_context['link_manager'];
+    // Remove extra User fields when access was limited to 'view label'.
+    if ($entity instanceof User && empty($entity->mail->value)) {
+      $this->values = array_filter($this->values, function($value, $key) {
+        return ($key == 'name' || $key == 'uuid');
+      }, ARRAY_FILTER_USE_BOTH);
+    }
     // Get an array of arrays of includes.
     $this->includes = array_map(function ($value) {
       return $value->getIncludes();