Answer: First, I must ask what is the reason for photos of tenants and occupants? I suspect there may be a legitimate reason, but if you cannot explain it (other than “we’ve always done it that way”) you might consider discontinuing the practice. I do agree that it is premature to get pictures of prospective tenants, etc., until they have been accepted as tenants. Thereafter, if there is a legitimate reason for the information, you make take the pictures. A photograph consensually given, is not, in my opinion, illegal if it serves a legitimate business purpose.
Second, assuming there is a legitimate reason, my concern would be what happens to the photos thereafter. You might want to consider scanning and keeping the personal photographic information in a secure electronic storage, away from the risk of indiscriminate access.
This same advice applies to any confidential consumer information (e.g. social security numbers) – keep it safely stored, as you could be held liable for the theft or abuse of this information. When the tenancy has ended, photos and personal information should be destroyed.