Replying to @baekdal
The publication/transparency requirements on legitimate interest could be strengthened, which puts the onus of responsible behaviour back on the data controller, where it belongs. I believe that would have a genuine positive impact.