The legal basis is that there are no stronger requirements as "there has to be somebody listed" made by the registry for the TLD, which is a (more-or-less, depending on the case) private entity and can set those rules, within the ICANN guidelines.
more theoretical: Why shouldn't it be allowed?
Building ownership or IP can also be done "privately" through companies. I bet many people owning domains are thankful that their personal information is NOT so easily accessible, and if there is a strong public need (legal case, prosecution) the intermediaries will hand out the information. Where required they'll also forward messages they are sent.
FWIW, here in Germany it is harder to do so and I don't like it, because it connects my website to myself a bit too easily, and I don't even publish particularly critical stuff.
What need do you have that is more important than the rights of the owner?