Yes, if you have their consent, you can post their photos online or on any medium. If you don't have permission, you should blur or remove the person(s) photo before posting concerning the individual's privacy in the photo.

Avoid uploading to online image editors or mobile apps that may store the photo on their servers and use it for whatever purpose. 

No. The student number is considered Personal Information that can identify the individual. Regardless of the exam result, students consider exams and grades private data.

Data collection should follow the principle of proportionality. Only collect what is necessary to process the data according to your units' functions. If you need to collect data that is not required by your unit, you must obtain consent from the data subject and state the collection and processing purpose.