...
ICANN org acknowledges that this is the EPDP Team’s assumption at this stage. We also note Bird & Bird’s Phase 2 “Liability” memo to the EPDP Team (9 September 2019), which stated that “the most likely outcome – and certainly most supervisory authorities’ starting position – is that CPs are controllers – and, given ICANN's role in determining purposes and means of processing, that they will be joint controllers with ICANN org in respect of their disclosure of Registration Data to Requesters via a SSAD.” Once the recommendations are finalized by the EPDP Team, approved by the GNSO Council, and adopted by the Board, this issue will be addressed during the implementation process.
...