Privacy issue, with users being able to see other users profile pages when they shouldn't

[davefoord]

I have just found (to my horror) that even if the permissions are set so an authenticated user cannot view other users profiles, if they do try to visit someone else's profile, it still shows that users name and picture (the other bits are hidden as expected) - this is obviously a complete violation of data privacy.

Can this be looked into please?