In 99.9% of cases defining legitimate use is simple. There should be legal consequences for data sharing that is not actual legitimate use. I see companies making absurd claims about what consent based on "legitimate interest" can mean. No, sharing data with advertising "partners" is not based on any legitimate interest. If these companies were getting some strong fines for illegal stuff like this, then they would cut the bs.
> Hey, please send the shipment to my customer. No, I can't tell you the address, it's personal data.
Some data sharing will always be necessary. What needs to be banned is the unnecessary sharing, but it's hard to 100% define what counts as necessary