You don't need GDPR for this to have legal issues.
As an amateur photographer, I'm pretty sure that you'd formally need a model release form for a commercial use of it to be legitimate[1].
Of course, as with any legal issue, the company would weigh the probability of it being enforced vs. the hassle of doing it right... and it's pretty clear where the balance is in most cases.
As far as photography is concerned, the act of making a photograph and giving it away to someone constitutes publishing. Here, the engineer published the photo by giving it to his employer (and making it a part of the test suite).
Not publishing would be keeping it to himself, which the engineer did not do. For all we know, his girlfriend did not consent for that photo to be distributed to other people. Model release forms exist for that reason.
But that's not merely a publishing consideration anyway; the law is more general than that.
In the end, it's someone's face being used for a commercial purpose without consent, and this is exactly what the law is about.
As an amateur photographer, I'm pretty sure that you'd formally need a model release form for a commercial use of it to be legitimate[1].
Of course, as with any legal issue, the company would weigh the probability of it being enforced vs. the hassle of doing it right... and it's pretty clear where the balance is in most cases.
[1] https://www.dmlp.org/legal-guide/using-name-or-likeness-anot...