You need consent if the photo is taken at a private place or function. If consent is not available, it is best to blur or remove the person(s) in the photo before posting it.

Whenever possible, avoid uploading photos to online image editors or mobile apps that may store them on their servers and use them for any purpose. 

No. The student number and the exam result are considered Sensitive Personal Information under the DPA (see definition below). Regardless of the exam result, students consider exams and grades private data. Posting publicly might lead to bullying, anxiety, or shame, especially for those who got low scores.

DPA of 2012 Chapter 1 Sec.3(l) defines sensitive personal information as follows:

Sensitive personal information refers to personal information:

1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
4. Specifically established by an executive order or an act of Congress to be kept classified. 

Data collection should adhere to the fundamental principles of data privacy, including transparency, proportionality, and a legitimate purpose. Only collect what is necessary to process the data under your department's functions. If you need to collect data that your department does not require, you must obtain consent from the data subject and clearly state the purpose of the collection and processing. 

Note that processing of sensitive and personal information must adhere to Sections 12 and 13 of DPA 2012.