It also sets up peculiar legal fictions, i.e., it is ok to keep contact info for 'legal' persons, but not 'natural' persons and if the 'legal' contact info hints indirectly about a 'natural' person, that's a violation, unless, I'm sure a series of other conditions and legal fictions are satisfied. The 8 pages are dense with impenetrable legalese, and the message essentially is that ICANN is not allowed under GDPR to fulfill its mission of publishing the identities of website owners to the public. That is not a reasonable position, from a US perspective. Why is only a government inquirer allowed to know such things automatically, why must my request as a member of the public be logged for ICANN to fulfill it? Is that actually beneficial to 'privacy' or a derivative GDPR minefield?
GDPR is a negative development for openness, tranparancy and interconnectivity.