Sorry to be that person, but I think this is probably a good example of something which is covered by the GDPR. OP has built profiles and is storing information about people, which makes them a data controller under the GDPR, and subject to its extraterritoriality provisions, as some of these users will be EU/UK citizens. I don't believe the exemption for personal use applies, as the data is being published.
If I remember correctly, they're now supposed to contact each person individually, explain why they're storing their data, and obtain their consent.
In practice, the chances of someone making a complaint and the issue being enforced are extremely low.
I'd not seen that part of it before. I think the trick word here is "manifestly", and some sources seem to indicate that this means that the people would have to have expressly given consent for onward processing.
If I remember correctly, they're now supposed to contact each person individually, explain why they're storing their data, and obtain their consent.
In practice, the chances of someone making a complaint and the issue being enforced are extremely low.