I think it is a 4xx client error, and not necessarily one that needs a new status code. It seems to me that it is a fairly simple case of 403 Forbidden:

  The server understood the request, but is refusing to 
  fulfill it. Authorization will not help and the request 
  SHOULD NOT be repeated. If the request method was not HEAD 
  and the server wishes to make public why the request has 
  not been fulfilled, it SHOULD describe the reason for the 
  refusal in the entity. If the server does not wish to make 
  this information available to the client, the status code 
  404 (Not Found) can be used instead.