The Latvian Data Protection Authority (DVI) has clarified the conditions for using children's personal data, including their photographs, in artificial intelligence (AI) tools.

Using the example of a teacher wishing to use students' photos to create an animated video via an AI tool, the authority reminds that consent given for a specific processing, such as publication on the school's website, does not constitute general authorization. Importing personal data into an AI tool is a processing in itself, which requires a separate legal basis and prior information to the parents. The institution, as the data controller, must define the purpose, ensure the necessity of the data collected, and comply with the principles of Article 5 of the GDPR.

The authority also emphasizes the obligation to assess the AI service before any use. It is imperative to verify whether the provider retains the data, uses it to train its models, shares it with third parties, and how it manages their deletion. This assessment must also determine the need to conclude a data processing agreement in accordance with Article 28 of the GDPR and to comply with rules on data transfers outside the European Economic Area. The DVI recommends adopting alternatives that do not require personal data, such as using fictitious data to generate document templates or illustrations for creative projects.