What are X’s liabilities?
Based on the information given, there is neither liability for defamation nor for data privacy.
I understand that there is a case of defamation here.
That is inaccurate. Offensive comments could lead to a viable claim of defamation only if they contain enough factual connotation that is false and tends to harm the professor's reputation. Actionability depends on whether (1) those statements of fact lead to provable losses; or (2) the law recognizes them as defamatory in and of themselves, that is, regardless of the context (under U.S. defamation law, this is known as defamation per se).
If comments are truthful or they veritably constitute statements of opinion, they are not actionable under defamation law.
The professor's "severe depression" itself does not trigger actionability.
What I’m not sure is whether There is a data privacy case in this particular scenario.
The university's publication of the professor's picture preempts any actionability for other's act of posting that picture elsewhere. In other words, since there was no privacy to begin with, there is no privacy to protect.