but piwigo needs the user and the group to be www-data

no, not "piwigo" need. your webserver need. because webserver process is launched by user www-data (you could use a process viewer to check that). i think they make this default to protect against possible transversal attacks ( https://en.wikipedia.org/wiki/Directory … sal_attack ).

i had this kind of problems myself, while PHP-CGI process was started by root, my NGINX process was started by the user www-data. Because of that the webserver had problems in accessing some files, I had to chown the files to www-data.
nginx webserver let you change the user of the process in the config file https://nginx.org/en/docs/ngx_core_module.html#user . i have set mine to "root" and since then i don't have problems with file permissions. of course this is less secure but give the webmaster less headaches.