Always avoid lawyers. Plus, I can't afford lawyers. One thing that I will say that UDRP is pretty cheap, which is great because it's a low barrier to entry for those that need mediation. People that infringe on other people's rights maliciously don't have a right to privacy. Even in Namecheap's registrant agreement it says that if there is a request for information then they will dish it out to those that request it, as they should in my opinion. But, they don't follow their own Ts & Cs which is what bothers me the most about them, but that's a story for another day.
The thing about privacy is that it is something that it is awarded online but not in real life. There's privacy to get on with your day to day business and then there's privacy that goes too far and protects purposely bad people. I would draw the line where people start acting badly. GDPR privacy shouldn't protect people that act badly or where they are infringing rights or being abusive from those that they affect.