Over the past decade more people are taking pictures of more people and posting them on social media - including WhatsApp (which is considered to be social media, legally). If the subject does not know they are having their picture taken, and does not consent to it being shared, then this is breaking GDPR. It is unreasonable to think people won't take pictures; but students should at least be aware of the laws and the possible consequences of breaking them.