As far as photography is concerned, the act of making a photograph and giving it away to someone constitutes publishing. Here, the engineer published the photo by giving it to his employer (and making it a part of the test suite).
Not publishing would be keeping it to himself, which the engineer did not do. For all we know, his girlfriend did not consent for that photo to be distributed to other people. Model release forms exist for that reason.
But that's not merely a publishing consideration anyway; the law is more general than that.
In the end, it's someone's face being used for a commercial purpose without consent, and this is exactly what the law is about.
Not publishing would be keeping it to himself, which the engineer did not do. For all we know, his girlfriend did not consent for that photo to be distributed to other people. Model release forms exist for that reason.
But that's not merely a publishing consideration anyway; the law is more general than that.
In the end, it's someone's face being used for a commercial purpose without consent, and this is exactly what the law is about.