You can under the right circumstances. For example, on my name's .co.uk, it says: The registrant is a non-trading individual who has opted to have their address omitted from the WHOIS service.

For companies and organizations though, yeah, they have to be public, but I think that's fair enough.

Nor .io domains.

My .io (finn.io if you want to look it up) says:

  Owner Addr    : Obfuscated whois Gandi-63-65 boulevard Massena
  Owner Addr    : Obfuscated whois Gandi-Paris
  Owner Addr    : WA
  Owner Addr    : FR

and my full name. Seems obfuscated enough, especially since the name was not remotely validated.

Maybe it's just the service you use? My .io has masked whois.

I am using Namecheap and it masks .io domains using Whoisguard.