Having access but pretending not to seems like the worst of both worlds.

Various entities will still be able to get to the data, while users might incorrectly assume that that's not the case.