If the grandmother took the pictures she would have copyright over them. But the GDPR isn't concerned about copyright but instead the handling of personal data

If the grandmother took the pictures she would have copyright over them. But the GDPR isn't concerned about copyright but instead the handling of personal data. I don't think it's a stretch to consider one's photo to be personal data. Social media sites are mined for photos to be used for facial recognition apps. While you're concerned about the slippery slope of being able to post what you want online, companies and individuals right now are using your photo in ways you probably didn't imagine. I don't think it's clear cut.