The big problem remains
This is far from the breakthrough for privacy it appears to be from the article. The decision that FashionID is not a joint controller for the subsequent processing by Facebook is the crocodile on the sofa. The data subject is forced to sit on the sofa by FashionID, but whether the crocodile (Facebook) bites is not deemed to be under its control.
Joking apart, the fundamental intrusion into privacy is not the information that a data subject visited this specific site (the collection of which is under the control of FashionID) but the cumulative profile of the data subject's browsing, which is entirely and solely under the control of Facebook. The latter's reliance on the vastly abused lawful basis of "legitimate interest" allows a data subject to object, but fat chance of this highly lucrative profiling being abandoned. The best offer of redress that has been made to me in a similar case is "you are free to submit a right to be forgotten request after every transaction".
The one benefit of this judgement is that it provides grounds to object to a web site owner where automated and/or covert tracking is in use, but once again I don't hold out much hope of such an objection driving change. Legislation is toothless unless those constrained by it actually care.
Biting the hand that feeds IT
