In most circumstances, yes. You are on their property and have no expectation of privacy. On this basis employers can and do deploy CCTV monitoring of employees and public, and taking photos is no different. This will not apply in 'private' areas such as toilets, rest rooms etc. where privacy is expected.

Publishing on the web doesn't change things unless the site advertises or promotes in a manner that implies endorsement by the employee. This would require a model release unless a release is included as part of the contract of employment.

Clearly an employer who ignores the wishes of employees is acting insensitively, but we don't think illegally.