Re: so who do you report abuse to, now?
you misunderstand gdpr. If the visible registrar contact is a person then that IS personal data. Natwest have personal data on its employees. These employe3s data is needed to perform duties, it is reasonable that a registrar needs a contact in Natwest. Natwest are the data controller. They use a registrar as a data processor and will need a GDPR policy agreement with them. By the registrar posting identifiable data publically they are breaking GDPR as a data processor. Natwest will not be liable for the breach as the controlller as they have shown diligence with an agreement with the data processor.
they do have an agreement right? uh oh. if not that is in the 4% fine bracket if they have not bothered to get agreements. 2% bracket if they have at least some agreements.