Sorry, Narg, but I have to disagree on this point. It’s perfectly easy to construct legislation that would be narrowly tailored enough to deal with the specific issue being presented here without any risk of overregulation. Whether they’re necessary is another point – I think generally they are, for the same reason voyeurism is illegal.
It’s simple enough: The boyfriend knew she intended the picture only for him. He knew the tendency for rumors to snowball beyond anyone’s control. In particular, he specifically knew (or should have known) how quickly stuff like this spreads online. Yet he chose to send the pictures anyway. The effect of the behavior is clearly an invasion of privacy. If he had plastered physical copies of the photo all over town, or had mailed hard copies to everyone in the student directory, he probably would have got in trouble. But the laws (apparently) don’t extend to this.
There is plenty of precedent for invasion-of-privacy laws. The First Amendment is no bar to regulating invasion of privacy, because it is not an absolute bar. Other rights must be weighed against it, and in this case, the subject’s right to privacy has been historically recognized as generally trumping free speech in similar circumstances. Were it otherwise, anti-upskirt-cam laws would be unconstitutional, and so would laws preventing wiretapping.
In this particular case, I see no problem with a regulation prescribing that adult photos of real people (with an appropriately narrow definition) cannot be forwaded, or otherwise republished, to anyone the sender does not give permission to disseminate them to. Porn producers already have contracts and other legal paperwork with their actors and actresses, all they have to do is add a mandatory “I acknowledge that the acts in question will be distributed to the world at large” disclaimer. Similarly for websites that permit user-uploaded content; it’s just another paragraph in the Terms of Service. To avoid problems with the huge existing body of material, exempt all previously-produced images. To avoid someone sending pictures, then claiming the recipient himself is unauthorized, the act of sending could be considered consent for the recipient to receive the images.
EDIT: Of course, this would be a reasonable approach to the problem. As such, this will probably be nothing like the regulation actually proposed, which will no doubt be outlandishly outrageous. Like make the person who sent the photos (i.e. the victim) responsible for invading his/her own privacy, or force all camera manufacturers to prevent their products from being used to take nekkid pictures.