The SHOCKING Truth About Influencers Filming in Public Spaces and Institutions: What Nobody Tells You
For some time now, social media has been flooded with a growing trend: individuals entering shops, town halls, or hospitals with their phones recording, reciting a couple of legal articles from memory, and aggressively filming staff who don't even work with the public. Under the guise of "legality testing" or "activism," they claim an unconditional right to film anyone, anywhere, at any time. However, this is an illusion fueled by a selective interpretation of the law. This article debunks the myth of "unrestricted recording," breaks down the actual legal framework, and clarifies where public transparency ends and the violation of fundamental rights begins.
Let us be clear: reporting irregularities in public institutions and holding authorities accountable are legitimate and necessary actions in a democratic society. The issue is not the desire to expose a dysfunction, but the method chosen: deliberate provocation and the harassment of employees who have no role or responsibilities in public communication.
Why influencers believe they can film everywhere
Because the police are, technically, right when they say filming in public space isn't prohibited. The problem starts when influencers stretch that correct statement to places it simply doesn't cover.
Public space means the street, a park, a square — areas with no access regime set by an administrator.
Space accessible to the public is a different thing entirely: a city hall, a hospital, a shop are places the public may enter for a specific purpose, but they remain private or administrative premises, with rules set by the institution that runs them — not by the person who walks in with a phone.
Police often appear to side with the person filming simply because, as a rule, they have no authority to interpret GDPR or an institution's internal access rules — their role on the ground is keeping public order, not settling a data-protection dispute. An officer's lack of intervention at the scene doesn't mean the filming is lawful — it just means the police aren't the competent authority to determine that on the spot.
The key distinction: public officials vs. private employees
The law does not treat everyone filmed inside an institution the same way, and that's where most of the confusion comes from.
For public officials, police officers, gendarmes and elected officials, while performing their duties (a street intervention, a public meeting, an official hearing), a real exception to image rights applies. Article 75 of the Romanian Civil Code provides that using a person's image to inform the public is not a violation when it concerns a public figure, in connection with the exercise of their function. This is the legal mechanism that allows the press and citizens to document the activity of authorities — a legitimate form of public accountability.
For everyone else — an office clerk, a shop employee, a doctor in a consultation room, a DPO who has no public reception hours — this exception does not apply. The default rule applies instead: the right to one's own image, protected under Articles 73-74 of the Civil Code, requires the person's consent for both capturing and publishing their image. An ordinary employee does not become a "public figure" simply because they work for a public institution or in a space open to the public.
Filming is not the same as the right to information
A common argument used by those filming is the right of access to public-interest information (Romania's Law 544/2001). This conflates two different things: the right to request information and the right to obtain it by whatever method the requester chooses. The law guarantees access to information, but it doesn't require an institution to answer verbally, on the spot, in front of a camera. The correct legal channel for requests and complaints is a written one, governed by Government Ordinance 27/2002 on handling petitions: the request is submitted in writing, and the institution must respond in writing, within the legal deadline. An employee declining to give an instant, on-camera answer is not a breach of the law — it's the correct application of procedure.
The real legal framework: GDPR, the ECtHR, the CJEU, and hospital access rules
GDPR — an image remains personal data. Under Regulation (EU) 2016/679, the image of an identifiable person is personal data (Art. 4), and any filming is a processing activity that requires a valid legal basis (Art. 6). Special categories of data, such as patients' medical information, receive additional protection (Art. 9).
CJEU, Buivids case (C-345/17). The Court held that a person who films and posts to social media cannot rely on GDPR's exemption for "purely personal or household activity" — that exemption is strictly reserved for the private, family sphere, not content aimed at the general public. The same ruling also recognized that a person may invoke the journalistic-purposes derogation (Art. 85 GDPR, transposed via Article 7 of Romania's Law 190/2018) even without press accreditation — but only if the activity genuinely serves to inform the public. The two conclusions aren't contradictory: GDPR applies in full to the filming itself, and the journalistic derogation, if invoked, must be demonstrated through the actual content, not merely claimed.
ECtHR — the proportionality test. The European Court of Human Rights set out this test concretely in Von Hannover v. Germany (No. 2), establishing the criteria for balancing the right to private life (Art. 8 of the Convention) against freedom of expression (Art. 10): the material's genuine contribution to a debate of general interest, the notoriety of the person filmed and the actual subject of the footage, and the prior conduct of the person concerned. Freedom of expression does not cover scandal-seeking, intimidation, or chasing views on TikTok or YouTube — that is precisely the kind of conduct the Court has excluded from Article 10 protection.
Order of the Ministry of Health 1365/2008. For hospitals, there is an explicit legal basis independent of the rest of the discussion: access for anyone carrying filming, photography or recording equipment requires the hospital manager's approval, and press representatives may film only in the areas the manager has explicitly authorized — implicitly banning filming in medical corridors, consultation rooms, emergency units, wards, laboratories, and any area involving patients or medical data.
In practice, this proportionality test is rarely met by people filming random employees, with no concrete, previously verified wrongdoing. A genuine public interest must relate to a real issue — a documented abuse, a proven dysfunction — it cannot be manufactured after the fact from the reaction of someone filmed without warning.
The person being filmed retains, in any case, the right to object under Art. 21 GDPR and the right to erasure under Art. 17, as well as the option of filing a complaint with Romania's data protection authority (ANSPDCP).
Filming and publishing are two separate acts
Capturing the image — the filming itself — already constitutes processing of personal data under GDPR and requires its own legal basis, regardless of whether the material is later published; claiming that the footage is kept merely as "evidence" for oneself does not remove the need for a valid basis under Art. 6.
Publishing and distributing online is a second, distinct processing act, with a disproportionately greater impact on the person concerned — the audience is no longer limited, the material becomes practically impossible to fully retract, and the harm occurs regardless of any later deletion. Even if, hypothetically, a basis for the filming itself were accepted, publishing it without consent separately opens the door to a civil tort claim for non-material damages, under Articles 252-253 of the Romanian Civil Code.
Places where filming is prohibited
- hospitals — medical corridors, consultation rooms, emergency units, wards, laboratories
- public health directorates, professional colleges (e.g., the College of Physicians)
- administrative offices with no scheduled public reception hours
- any area with visible personal data — files, screens, registers
- archives and premises with restricted access under internal regulations
Places where filming may be permitted, within clear limits
- public-service counters with declared reception hours, within the bounds of information-gathering rather than harassing a specific employee
- public information areas (notice boards, general reception) without identifiable individuals filmed in close-up without consent
- spaces with no visible personal data belonging to others
Even in these spaces, filming one specific employee, in isolation, without their consent, remains subject to the same consent rules discussed above — public access to an area does not equal consent to filming from everyone present there.
How some influencers manipulate the law, in practice
- conflate public space with space accessible to the public, as if they were identical
- cite legal provisions out of context, or ones that simply don't exist under the number quoted
- use intimidation and the social pressure of a rolling camera to force an on-the-spot response
- persistently film the person in front of them to provoke a defensive, filmable reaction
- edit and cut footage so the published version appears to prove them right
What happens when the person refuses to leave
Someone entering an office with no public reception hours and refusing to leave when asked by the person entitled to make that request isn't just a matter of manners — it's an offence under the Romanian Criminal Code. Article 225 (violation of professional premises) criminalizes exactly this conduct: unlawfully entering, or refusing to leave upon request, any premises where a natural or legal person — including a public authority or institution — carries out professional activity. The offence carries a prison sentence of 3 months to 2 years, or a fine.
Separately, if the filming targets private conversations or a person inside a private room or annex, the offence of violation of private life (Art. 226 of the Criminal Code) may also apply — the two provisions cover different situations and can, depending on the facts, apply together.
What institutions can do, concretely
Effective protection on the ground doesn't come from reciting the law on camera in real time — it comes from procedural preparation beforehand.
- Written rules, in the institution's internal regulations. Without a written policy adopted by the institution, the front-desk employee is left alone in front of the camera, and police cannot act decisively in the absence of a documented access policy.
- Clear signage at the entrance to non-public areas, such as: "Administrative area – unauthorized access and filming are prohibited under Order of the Ministry of Health 1365/2008 and Article 225 of the Criminal Code" (for healthcare facilities), or the equivalent legal basis for other types of institutions.
- Staff conduct: don't engage in improvised legal debates on camera; refer to the written complaint procedure; calmly request that filming stop and that the person leave the premises; call the police if the person refuses to comply.
- What police should record, once called: the refusal to leave the premises, disruption of the institution's activity, any intimidation or harassment of staff, access to a restricted area — all of these are relevant to Article 225 of the Criminal Code, regardless of whether the police themselves have authority over GDPR matters.
- If the material is published anyway: a complaint to ANSPDCP, a takedown request to the platform, and, separately, a civil claim for non-material damages — these three paths aren't mutually exclusive.
Conclusion
The freedom to film is not a license for abuse. Romanian and European law does not grant anyone an unlimited right to film any employee, in any context, under the pretext of a self-declared "legality test." Real exceptions exist — and they concern, primarily, the public activity of officials, police officers and elected representatives, not the rest of an institution's staff. Institutions, in turn, have a legal duty to protect patients, employees and the personal data they manage. For everyone else, the Civil Code rule stands: the right to one's own image is respected through consent, and refusing that consent is sufficient in itself, regardless of the justification offered by the person filming. When the law is applied correctly, the manipulation collapses.
This article is for general informational purposes and does not constitute legal advice for any individual situation. Institutions seeking an internal access and filming policy tailored to their specific activity should seek a case-by-case review.
Were you aggressively filmed inside an institution? The law is on your side far more often than you'd think — not on the influencer's, with the phone rolling.