On Sept. 24, the Court of Justice of the European Union handed Google a significant win when it decided that dereferencing all global search engines to fulfill a right to be forgotten request was a step too far for the EU's General Data Protection Regulation. 

The judgment underscores how the EU is moving to balance its citizens' various fundamental rights and countries' differing perspectives on those rights when enforcing the GDPR. In essence, the Google ruling signals that the EU doesn't want to overreach, lawyers said.

"I think this decision emphasizes when it comes to published information there could be geographical considerations because often there might be an issue of balancing different interests and countries have differing views of balancing those interests," said Dorsey & Whitney partner Ron Moscona. He added, "When the GDPR engages issues of freedom of speech or access to information there might be situations where compliance may not be uniform across the world."

Still, while the ruling drew interest because of its potential impact on global search engines and journalism, lawyers noted the decision doesn't restrict the right to be forgotten from being applied globally.

"If the order requires materials to be taken down, it has to be about a grave situation regarding an individual's privacy, [then] there's a more likelihood the authority will want this to be done globally to make [the materials] inaccessible, period" Moscona said.  

However, he added, "You don't need to do something extreme if the interests that need to be protected aren't quite that serious, [but] that's a little bit of speculation on my part."

To be sure, Maarten Stassen, a Brussels-based Crowell & Moring partner who was not involved in the legal matter, noted that proportionality—in other words, the balancing of fundamental rights—has always been the focus of EU courts. In 2014, for example, the European Court of Justice declared the Data Retention Directive invalid in 2014 on the grounds it violated privacy and protection of data rights by requiring telecoms and internet service providers to retain certain data for at least six months to two years.

Still, the CJEU's proportionality ruling provided further GDPR clarity for international companies, lawyers said.

"It clarifies the territorial limitation of the GDPR, which has been a difficult issue for international companies to identify … because of the extraterritorial effects in the GDPR," said Ireland-based McCann FitzGerald partner Adam Finlay.

Other lawyers also praised the judgment's ruling for being balanced.

"I think it's a balanced opinion, and I think there will be ramifications not only in the EU but clients I represent in the U.S. that are concerned with the reach of the GDPR," said David Lucas, a Huntsville, Alabama-based Bradley Arant Boult Cummings partner. He added, "I think it is helpful that the court itself addressed the cross-border issue in the decision by noting the lack of extraterritorial language in the legislation. In doing so, it reduced the risk of territorial overreach many have been concerned with."

Although the decision further signals the EU will carefully consider proportionality when enforcing the GDPR, it didn't provide a clear proportionality balancing test for courts or regulators, thereby acknowledging that case-specific facts could lead to differing outcomes.

"That's the most significant element of this decision," Moscona said. "Obviously in most cases the law says what the law says, but in the case of the GDPR there are various circumstances where the provisions of the GDPR are subject to various exceptions that relate to other interests, whether freedom of speech, freedom of information, national security and other competitive interests."

Suffice to say, EU courts will most likely face more proportionality questions in the months and years to come.

"I think we will inevitably see a lot of further cases and ultimately decisions because it's not clear exactly where the balance should be drawn," Finlay said.