epicenter.works

epicenter.works is a Vienna-based digital rights organization that advocates for the preservation of fundamental rights in the digital age — with a particular focus on privacy, mass surveillance, net neutrality, and emerging threats from digital identity infrastructure and AI systems. Founded in 2010 as Arbeitskreis Vorratsdaten Österreich (AKVorrat) by a coalition of lawyers, technicians, and concerned citizens mobilizing against Austria's data retention law, and renamed in December 2016 to reflect its broadened scope, the organization has produced some of Austria's most consequential digital rights victories: a citizen's initiative that attracted 106,067 signatures in 2012 — the largest of its kind in Austria at the time — and a constitutional challenge that contributed to the European Court of Justice's complete annulment of the EU Data Retention Directive in April 2014. Since becoming a member of the European Digital Rights (EDRi) network in 2016, epicenter.works has been one of its more operationally capable member organizations: Thomas Lohninger, executive director since 2014, has served on the EDRi board since 2019.

Origins: AKVorrat and the data retention fight

The organization first presented itself publicly in December 2009 at the University of Vienna, in the context of student protest movements, and was formally established in February 2010 as AKVorrat — Arbeitskreis Vorratsdaten Österreich, a working group formed specifically to contest Austria's implementation of the EU Data Retention Directive, which required telecommunications providers to store the traffic and location metadata of every citizen for six months. Its founders were lawyers, technicians, and concerned citizens, and from the outset the group operated through a combination of legal strategy and mass civic mobilization rather than insider advocacy. The grassroots character established in this founding period has persisted: the organization relies substantially on volunteers across legal, design, programming, and translation functions alongside a small paid staff.

The CJEU data retention victory

AKVorrat launched a citizen's initiative against data retention in Austria via the platform zeichnemit.at, which had gathered 106,067 signatures by April 2012 — described at the time as the largest Austrian citizen's initiative on record. Beyond the petition, the organization organized over 11,000 plaintiffs in a constitutional challenge against the directive. This effort was part of a wider European coalition whose pressure contributed to the Court of Justice of the European Union issuing its ruling in April 2014, annulling the EU Data Retention Directive in its entirety — the first time in European legal history that a directive had been struck down whole. The CJEU ruling became a reference point for the continental digital rights movement, and AKVorrat's citizen mobilization was the Austrian anchor of the challenge.

Net neutrality and the European campaign

Following the data retention victory, AKVorrat — soon to become epicenter.works — took a leading role in the European campaign to enshrine strong net neutrality protections in EU law, operating through the SaveTheInternet.eu coalition. The campaign successfully secured legal protection for net neutrality at EU level, establishing the principle that internet service providers cannot discriminate between types of traffic. The net neutrality fight deepened the organization's engagement with EU regulatory processes and extended its reach from purely Austrian legal mobilization to cross-border coalition advocacy — a trajectory that presaged the December 2016 rebranding and the EDRi membership of the same year.

Surveillance, spyware, and digital identity

Since the rebranding, epicenter.works has concentrated on a cluster of interrelated issues: resisting the expansion of government surveillance powers in Austria (the organization four times prevented the passage of government spyware legislation through mobilization and legal challenge), opposing the EU eIDAS digital identity framework in forms that could enable mass tracking, and contesting structural problems with the EU's Digital Identity Wallet. Its project whoidentifies.me documents the identity verification landscape in Europe. In parallel, a junior policy advisor role focused specifically on AI and human rights signals the organization's attention to emerging algorithmic threats.

Structure and independence

epicenter.works operates with roughly nine paid staff — policy advisors, a communications manager, and an IT security specialist — alongside substantial volunteer contributions. Funding comes primarily from micro-donations by individual supporters, supplemented by foundation grants — the Open Society Foundations were the largest institutional supporter until their 2023 withdrawal from European grantmaking, during which they contributed roughly €158,000 annually — and sponsorships from technology-sector companies, with declared ethical limits: no single company may account for more than 7.5 percent of the budget, and the entire private sector may not exceed 30 percent. Executive director Thomas Lohninger has led the organization since 2014; managing directors Tanja Mally and Daniel Lohninger jointly oversee operations and also lead epicenter.academy, an associated educational arm.