Even with privacy services enabled, all it takes is a simple legal filing to compel the domain privacy service to reveal the actual owner of the domain (or risk being sued themselves, since as I understand it, technically they are considered the owner of the domain, and are therefore liable if they are listed on WHOIS).
All that privacy services provide is a filter, a way to initially throw off people performing casual searches of WHOIS. The privacy service providers are mostly interested in collecting millions from domain owners for privacy protection (not actually providing solid privacy protection). Some of them will even sell this private information to interested buyers.
ADG