Yes, you need consent if the photo is taken at a private place or function. You should blur or remove the person(s) photo before posting it.

As much as possible, avoid uploading to online image editors or mobile apps that may store the photo on their servers and use it for whatever purpose. 

No. The student number is considered Sensitive Personal Information under the DPA (see definition below). Regardless of the exam result, students consider exams and grades private data.

DPA of 2012 Chapter 1 Sec.3(l) defines sensitive personal information as follows:

Sensitive personal information refers to personal information:

1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
4. Specifically established by an executive order or an act of Congress to be kept classified. 

Data collection should follow the principle of proportionality. Only collect what is necessary to process the data according to your units' functions. If you need to collect data that is not required by your unit, you must obtain consent from the data subject and state the collection and processing purpose.