Within the new GDPR it's necessary to give students the possibility to hide their user picture for other users; only teachers who actually teach this students should have the right to view the profile picture.

At the moment there is only one(as far as I know) setting: the right to upload set pictures or not.

I think it would be a great improvement to add 3 things:
-add the right to change the profile picture(set to different roles, not depending on the upload-right)
-add the possibility for a user to define whether his/ her  user picture can be seen in 'general pages'(not course related, so for authenticated users in general)
-add the possibility for admin to define which roles a student can exclude from seeing his/ her profile picture; the user should then be able to define in the profile page (privacy settings) to define some roles from this list.Of course, a user can have different roles, so this profile-setting should only have effect in courses where he or she is enrolled as student.