I forget where I saw it, but I thought this was a good test of whether it is legitimate interest. It went something like:
"Would a 'reasonable' person be surprised if you told them about how you were using the data?"
"Would a 'reasonable' person be surprised if you told them about how you were using the data?"
I'd prefer to have hard limits. No collecting any info from my computer about me that aren't explicit in the interaction itself (asking for email is ok; scraping installed apps while doing that to gauge my interests is not)
If the language of a new law uses it with regards to a new technology, then no one can be sure what the courts will decide.
It may be different in the EU, as the legal system is quite different.
Obviously one would have to explicitly exclude from the "reasonable" test the kind of surprise that was not triggered by Snowden, because otherwise all our greatest fears would become legal by definition.