> Regardless of how the rules are presently defined, that would _never_ stand up in court

IANAL, but I agree. When you sign up for privacy protection, you're hiring the registrar to act as your agent. If they then act outside their granted authority as such, then they're doing so in breach of contract. I believe that's called 'conversion'.