They likely can't, but they can fine EPAG, which is a German domain registrar. The matter at hand is that ICANN was trying to allegedly force EPAG to violate GDPR.