Problem is, some domain and number holders have no incorperated body: they hold the resource as a private individual. Hard to formulate consistent data law around WHOIS when its both people, and corporate entities.

I was in the WHOIS as was from SRI-NIC. I kept GM85 in my current nic-hdl for resources as a memory of the days gone by: they even published a paper copy of the listing.. the phone book of the internet, how .. quaint.

Yes, the protocol is designed for days gone by. but the GDPR laws apply to RDAP, even though it has HTTPS and could in principle use Oauth or similar to constrain whats shown to open access.