Author here. The argument the data commissioner makes is that, while the images are public, users can assume they are protected from other purposes, e. g. facial recognition, because of the ToS which disallow bulk download. Thus, by violating the ToS, we also violated their personal rights. However, you need to be aware that this is an interpretation of the data protection law, we don't know of any court ruling that would confirm such an interpretation, yet.