Seven years
The woman in question took down all the pictures of the kids except for one of her grandson - whom she looked after for *seven years* ("cared for from April 2012 through April 2019 while the boy and his father, separated from the mother, lived with her"). This is a grotesque misuse of GDPR.