> Transferring the Personal Data (Email address, name) of the people who
> funded the bounty could quite possibly be illegal under GDPR without the
> explicit consent of each person in question. At the very least it's a grey area.

That‘s what I think as well, see my comment #45 and the solution suggested therein.