as far as I understand their rules, this is not outright a rule break, however I do not know how much GDPR are part of any of the countries either of you are from, but here in Europe, it would be illegal to send a picture of someone else, without their consent, this would be on HIS side though, and should never have an effect on you..