This is already becoming a trend that bounty campaigns say that you need to go through the procedure of the KYC right before the distribution of the tokens.
I think such procedure must be anounced at the start of the bounty and people who don't want to give their data just won't take part in it. It will be fair enough.