pictures processing must be fair to the data subject.
pictures must only be processed for specific and legitimate purposes, outlined in your privacy policy.
Don't collect more pictures than you need.