Security requirements for profile pictures: photos should be treated as sensitive PII and part of LCAP.