http://www.xmpp.org/extensions/xep-0054.html
A quick skim of xep 0054 shows that there is nothing in the protocol about vCards being private. However, that XEP hasn't been updated in 5 years, and perhaps we should propose an update. It seems like having 2 kinds of vCards, a "public" and a "private" would make sense.
