I doubt the latter part is entirely true, especially post-GDPR. Privacy law always depends on the balance between legitimate interest and personal rights.

Also this article from 2013 seems to indicate that while it was legal to film people in private at some point that already changed before the GDPR: https://www.pcworld.com/article/2040434/secretly-shooting-vi...