Today's ruling by the ECJ on the Google v CNIL case seems to limit the territorial scope of the GDPR.

But that misses the main point of the ruling. First, the analysis is specific to the Right to Erasure. Second, it's more about the territorial scope of EU data protection authorities: they have no direct right to mandate changes to non-EU activity unless the authority first balances data subject rights against the freedom of information to show that such changes are necessary and proportional.

The last-minute Brexit deal essentially extends the transition period status for a few months with regards to data protection issues.