Re: "Necessary for performance of a contract"
I would have said that the ICANN argument has got to be along the lines of the fact that the provision of a domain requires registration with world DNS and a condition of this is provision of data to the whois service. This creates an argument that the contract between the site owner and the German registrar allows this because the German registrar isn't allowed to set up the domain without passing the information on. This then leads to a situation where the German registrar is the data controller but ICANN has status as a data processor and needs to comply with GDPR. It does muddy the waters but since the public availability of whois has not practical benefit to the discharging of any contractual obligations and only serves as a convenience I can't see any argument for allowing it other than ICANN claiming that their contract is not subject to GDPR and is covered by US law. That would then mean that no company can legally operate as a registrar in Europe and probably then goes on to the full enforcement of GDPR meaning that no personal data of a European can be passed to/through the USA or be held by a US or US owned company.
I really hope this doesn't turn into the equivalent of a nuclear exchange as it will devastate the world economy but that seems to be the stance ICANN are taking.