It's worth noting, as well, that this part of the law hasn't changed at all. The changes to GDPR are about notification and a variety of rights. Protection for leaking data to unknown 3rd parties is exactly the same as it was.

If using a 30 year old attack costing a few hundred bucks is considered undue effort then we are all save.

[1] https://en.m.wikipedia.org/wiki/Van_Eck_phreaking#LCDs

I would estimate the frequency of the attack similar to Lightnings killing people. I’m quite sure it happens but only in very small scale because you have to get so close to the victim.

If the customer is choosing to display his data on his screen while under risk of Van Eck phreaking, it's on him.

If you choose to display customer data on your screen while raising funds for launching a new cryptocurrency in the Sultanate of Kinakuta from sketchy Chinese generals, it's on you.