Hermes Center for Transparency and Digital Human Rights

The Hermes Center for Transparency and Digital Human Rights is an Italian non-profit civil-society organisation that fights for the protection of digital human rights and treats technology, in its own words, as "an enabling tool for freedom, not surveillance". Founded in 2012 by a group of programmers around the GlobaLeaks anonymous-whistleblowing project, the organisation has since become Italy's principal civil-society anchor on biometric mass surveillance, AI Act implementation, and the algorithmic-transparency interface between Italian and European-Union institutions, and is the corpus's first Italian entry alongside the EDRi Brussels network it has belonged to since 2018.

Founding and structure

Hermes was formally registered in 2012 after the GlobaLeaks project — initiated in late 2010 by Fabio Pietrosanti and shared into the Italian hacktivist community on 15 December 2010 — surfaced the need for an organised civil-society vehicle that could carry the underlying privacy-and-transparency agenda in Italy. The founding circle was drawn from the Progetto Winston Smith (PWS) community, described by EDRi as "the most active members of Italian privacy communities", and the resulting organisation has remained a hybrid of software production, research, and advocacy rather than a single-mandate policy NGO. Today the staff combine "technologies, lawyers and journalists" and advise democratic institutions on personal data, digital sovereignty, artificial intelligence, platform accountability, whistleblower protection, and open data.

The team is distributed across Milan and Rome rather than concentrated in a single headquarters office — the EDRi-coordinated Don't Spy EU coverage describes Hermes as "Milan-based", while the OONI project that the organisation now fiscally hosts is led from Rome. Fabio Pietrosanti continues as Founding Member and President; Arturo Filastò serves as a co-founder and Executive Director / CTO of OONI; Laura Carrer leads research and advocacy in the Digital Rights Unit; and Riccardo Coluccini handles EU regulations, advocacy, and campaigns. The organisation published a monthly newsletter, , that aggregates Italian and European digital-rights and AI-policy coverage for a civil-society readership.

Software projects

Two open-source projects anchor the organisation's software portfolio. GlobaLeaks is the anonymous-whistleblowing framework whose development Hermes leads and which is now in use by more than 300 organisations worldwide — investigative-journalism collectives, anti-corruption hotlines, whistleblower-protection lawyers, and a growing number of public-administration anti-corruption desks — and which the organisation has positioned as the technical foundation for the implementation of Italy's transposition of the EU Whistleblower Directive. Tor2web was the secondary project named in EDRi's 2018 member spotlight, a gateway making Tor-hidden services accessible over the regular web, retired in 2018 once the project's underlying assumptions about reverse-proxying onion services no longer matched the way modern hidden services were being used.

A third project — the Open Observatory of Network Interference (OONI) — sits in a hybrid relation: born in 2012 inside the Tor Project and since 2020 fiscally hosted by Hermes, OONI ships a probe-and-research pipeline that measures internet censorship across the world from open methodologies. The Mozilla Foundation in 2024 supported the launch of Makhno, an OONI-Hermes-built tool that exposes geographic patterns in social-media platform censorship — one strand of the wider OONI work-package that has fed the regular OONI Country Reports, the Tor Project's measurement requirements, and a long tail of academic-partnership research outputs.

Biometric mass surveillance and the Italian moratorium

Hermes Center's most consequential campaigning work since 2020 has been the multi-front challenge to biometric mass surveillance in Italy, conducted primarily through the Reclaim Your Face coalition that EDRi launched in October 2020 and of which Hermes was a founding civil-society partner.

The 2020 Como city investigation, conducted by Hermes researchers Laura Carrer and Riccardo Coluccini, exposed the unlawful deployment of a municipal facial-recognition system on the city's CCTV network and contributed to the system's shutdown. In May 2021 Hermes filed a joint complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) against Clearview AI — co-signed by Privacy International, noyb, and Homo Digitalis — that on 9 March 2022 produced an Italian DPA decision fining the company EUR 20 million, ordering it to delete the personal and biometric data of Italian residents from its scraped 10-billion-image database, ordering it to cease further processing of Italian data, and ordering it to designate an EU representative; the Italian decision was the first European national-DPA fine of its size against Clearview and was widely cited in the wider European regulatory record against scraped-image biometric databases.

On 16 April 2021 the Italian DPA rejected the deployment of the Sistema Automatico di Riconoscimento Immagini Real Time (SARI Real Time) facial-recognition system that the Italian Police had procured for live public-space biometric identification, finding that the system "lacks a legal basis" and would constitute a shift "from targeted surveillance of few individuals to the possibility of universal surveillance for the purpose of identifying certain individuals" — a substantive framing the corpus's Italian record on facial recognition has used as its anchor ever since. Hermes Center, credited as the Italian Reclaim Your Face lead, had pressed the DPA to conclude the investigation and secured public confirmation that 287 Italian municipalities that had received Ministry of the Interior funding to install new video-surveillance systems would not be permitted to attach biometric-recognition technologies.

On 23 June 2021 the organisation submitted a complaint against the ShareArt emotion-recognition system developed by ENEA in collaboration with Istituzione Bologna Musei and deployed in an Italian museum to infer the emotional reactions of visitors to artworks — arguing the system constituted "unlawful real-time processing of biometric data" without adequate consent or transparency and that such uses "should not be allowed in the European Union". The complaint contributed to the wider Italian and European pushback against deployment-by-stealth of emotion-recognition technologies in public-facing settings.

On 1 December 2021 the Italian Parliament introduced a temporary moratorium on private-sector facial-recognition use in publicly accessible places — covering shops, sports halls, and public transport — running until 31 December 2023 and enforceable through GDPR-style administrative fines, with law-enforcement and judicial-authority use exempted but conditioned on case-by-case DPA approval. The moratorium was the first national-level facial-recognition ban inside the European Union and was directly attributed by EDRi to the work of "Italian partners of the Reclaim Your Face coalition", with Hermes Center named as the lead Italian organisation; Laura Carrer's published commentary that the moratorium framing was too narrow — restricted to facial recognition rather than the full class of biometric mass-surveillance technologies — anchored the subsequent Italian and European push to broaden the prohibition language in the EU AI Act.

AI Act and AI redress mechanisms

Through 2022–2024 Hermes Center's policy work converged with the EU AI Act trilogue. On 23 November 2023 the organisation launched the Don't Spy EU campaign with The Good Lobby Italia and info.nodes — building on a first May 2023 campaign iteration — whose interactive site at dontspy.eu let users select an EU lawmaker and "scan" their photo with off-the-shelf remote-biometric-identification software, simulating both real-time identification and deepfake generation against the lawmaker's image to demonstrate that publicly available RBI tools are, in the campaign's own words, "virtually incapable of distinguishing" between authentic photographs and deepfakes. The campaign called on lawmakers to vote for a full AI Act ban on real-time and post-RBI in public spaces and explicitly opposed the partial-restriction compromises some Member States were proposing.

Since the AI Act's entry into force on 1 August 2024 the organisation has reoriented towards the implementation phase. In April 2026 Hermes presented a policy paper on AI redress mechanisms at the Italian Chamber of Deputies, on 26 February 2026 it ran a webinar on AI Act redress mechanisms with the Center for Democracy & Technology Europe, and on 11 May 2026 it published an open letter to the European Union pressing the Commission on the delay in establishing the AI Advisory Forum required under the AI Act. The redress-mechanism work — concerned with how individuals affected by AI-system decisions can access remedies under both the AI Act and the GDPR — is the organisation's current AI-policy spear-tip and is being developed in coordination with the wider CDT Europe / EDRi implementation cluster.

Coalition work

Hermes Center has been a member of the European Digital Rights (EDRi) network since 2 May 2018, part of a four-organisation simultaneous intake (with FSFE, NOYB, and Xnet) that brought the EDRi network to 39 members across 19 countries; through EDRi it co-signs the network's coordinated civil-society statements on the AI Act and on biometric mass surveillance, and Hermes's Italian work routes regularly into the EDRi member-spotlight and Italian-national tagged coverage.

On 7 October 2024 the organisation co-founded the Rete per i Diritti Umani Digitali (Italian Digital Human Rights Network) alongside Amnesty International Italia, The Good Lobby Italia, Privacy Network, Period Think Tank, and StraLi for Strategic Litigation — a six-organisation civil-society network presented at the Festival Digitale Popolare in Turin and committed in its founding manifesto to defending fundamental rights in digital contexts, promoting "governance autonoma per l'intelligenza artificiale" (autonomous governance for artificial intelligence), and proposing policies for ethical technology use. Within the network Hermes and Privacy Network share the privacy / mass-surveillance file, The Good Lobby Italia and Period Think Tank carry the inclusive technology-governance work, StraLi pursues strategic litigation, and Amnesty International Italia covers the freedom-of-expression-and-privacy frontier — a division of labour the corpus's Italian shape will follow as further entries are added.

Funding

Hermes Center's funding mix has historically been a combination of foundation grants, project-specific donor support, and small-scale private donations and volunteering. EDRi's 2018 Member Spotlight named Hivos (Den Haag) and the Open Technology Fund (Washington) as the organisation's principal foundation funders, alongside private donations and volunteer time. The 2024 Mozilla Foundation support for the OONI/Hermes-built Makhno tool sits alongside the longer-running OONI-side donor base, and the organisation continues to operate at a small-team scale relative to its larger EDRi peers — closer to the Italian civil-society norm for digital-rights NGOs than to a Brussels-policy-shop staffing model.

Posture in the movement

In the corpus's frame, Hermes Center occupies the technologists building free-software public-interest infrastructure who then carry the resulting standing into national and European policy on-ramp, with three features that distinguish it from its European peers. The first is the GlobaLeaks software-production base — the organisation's standing inside the wider European digital-rights field rests not only on its policy-advocacy outputs but on having shipped and maintained an open-source whistleblowing framework that hundreds of organisations now depend on, which has given Hermes a credibility with both technical-community and public-administration audiences that pure policy NGOs find harder to assemble. The second is the OONI fiscal-host relationship — the censorship-measurement research pipeline that OONI operates from inside Hermes makes the organisation an unusual hybrid of empirical-network-measurement infrastructure and policy advocacy, well suited to the Italian and European AI-policy environments in which technical evidence is increasingly load-bearing on regulatory decisions. The third is the consistently Italy-first stance — most EDRi members anchor their work at the Brussels-EU layer with national engagement as derivative, while Hermes's centre of gravity is the Italian DPA, the Italian Parliament, the Italian municipalities procuring biometric-surveillance systems, and the Italian civil-society Rete network, with the EU-level work treated as a complement rather than the primary surface. In the wider EDRi geography, Hermes pairs with Bits of Freedom (Netherlands), La Quadrature du Net (France), AlgorithmWatch (Germany), and the Panoptykon Foundation (Poland) as the principal national-level European digital-rights anchors operating around the AI-and-biometric-surveillance file, and is the corpus's first entry on the Italian wing of that map.