Similar to Ramhound, I also have two domains hosted through GoDaddy. I'm currently working to transfer them over to a better registrar, for privacy reasons. I use their private whois registration (Domains By Proxy). First and foremost, 'our' data is stored on their servers, so if their servers were compromised I suppose an attacker could extract private registrations.
More likely, if a registrar receives complaints or is contacted by authorities, you risk having your information handed over. For example, on DBP's website, at the bottom left-hand corner in the footer there is an area for authorities to request information about a domain and a 'file a claim' section for everyone else (copyright abuse, spam, defamation, etc.). A registrar would be legally obligated to comply with the police, granted they have a subpoena (welcome to America!). Though, there is a trend for companies to cooperate with the police without one, let alone evidence of wrong doing. I can only assume they would also work with attorneys, intellectual property owners, etc.
Although I wouldn't recommend it on a public forum (seeing as it's illegal), various users decide to provide false information during domain registration, that way the whois contains inaccurate information about the domain holder.
You may be interested in an article, "Private Domains Not So Private?" by CNET. TL;DR: DBP decided to drop a private registrar's account (without notice), therefore exposing his credentials simply to avoid the heat of hosting a controversial domain's registration.