There are multiple ways to deliver gated access to registrant data only to those who need to know (like EV cert issuers). See e.g. RDAP, a JSON/REST successor protocol to WHOIS, which displays different amounts of data depending on if you're logged in and what data your account has access to.
