The App_Data folder is a special .NET "system" folder in which IIS is configured to not allow the contents of that folder to be visible to web users. Create a different folder to store your images as you really should not allow App_Data to be web visible (if you can even change the setting).
For example, on Web servers that are hosting ASP.NET content, IIS 7 blocks several of the ASP.NET-related paths for you; Web.config, bin, App_Code, etc. Blocking these URL segments reduce the chance of an attacker being able to exploit these URLs for information.