ICANN is currently assessing if they are the data controller.
What is a data controller?
The Data Controller is a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed.
Who creates the purposes? The ICANN Community. Who is legally responsible? ICANN ORG.
Interesting is the legal opinion released a few weeks ago to the RDS WG. ICANN memorandum FINAL version – 25 September 2017