Google Flu Trends -- sliding down a privacy slippery slope?

Google's new service www.Google.org/flutrends to help the Centers for Disease Control spot likely outbreaks of the flu geographically certainly has benefits, but I was surprised at the minimal coverage of privacy implications of this in the mainstream media -- for example in the NYTimes and WSJ.  

• Per the NYT article: "Google Flu Trends avoids privacy pitfalls by relying only on aggregated data that cannot be traced to individual searchers."  

The big question here is can we take Google's word on this blanket assertion? There are excellent reasons why everyone should be highly skeptical.

• First, Google has fallen through most all Federal privacy law/policy cracks and really has no legal obligation or liability on privacy issues to speak of.
  • Google can comfortably assert whatever they want on privacy and be confident in the reality that they have no real Federal accountability or oversight for the privacy implications of their inherently interstate service.
• Second, Privacy International, a leading independent watchdog, ranked Google worst in its world survey on privacy and called Google "hostile to privacy" which does not inspire confidence. 
• Third, Google failed to comply with California privacy law to prominently post their privacy policy on their homepage until Saul Hansell of the New York Times helped shame them into it. 
• Fourth, I assembled what I consider a pretty compelling case in my testimony before the House Internet Subcommittee in July that Google was the single biggest threat to Americans' privacy.  

At a minimum, any assertions Google makes on privacy deserve an asterisk or qualification in news articles and a healthy dose of well deserved skepticism by reporters, editors and readers. 

Now lets get to the privacy substance of the new Google.org/flutrends service, with some very relevant and important questions for Google.

1. If the CDC/government asked Google for the names and addresses of those searching on flu terms to contact, warn or quarantine them -- would Google comply and what would be the Google policy and legal basis for Google's actions?
2. If the Government asked for the personal identification of people who searched for 'Bird Flu' or West Nile virus, two strains that are known to be much more deadly and dangerous as a potentially untreatable public health risk, would Google comply and what would be the rationale?
3. In other words, what is the point on the slippery slope where Google would feel compelled or would cooperate with public health official by disaggregating the data and giving the government the personal identifiers of those who typed in the search terms of a particular public health concern?
4. Has Google contemplated tracking HIV, a more horrible epidemic than the common flu and if so what would be the policy for disclosing personally identifiable information to the government on HIV searchers?
5. Would other sexually transmitted diseases get different treatment -- i.e. where would they be on this slippery slope?
6. What about someone who searched on tuberculosis and its symptoms from a mobile phone, would Google be under any obligation to give the authorities the exact geo-location of the person doing the search in order to effectively quarantine the individual and protect others physically around them?
7. Would Google have similar policies for all infectious diseases or would Google make its own judgements on which epidemics deserve government notification or should Government public health officials make that call?
8. Would one search on a public health concern be enough to trigger the Google algorithm or would it require multiple or different searches?
9. What exact key words would trigger the most alarm by Google or public health officials?
10. Could Google's algorithm also be able to inform Google or the Government about what pages the searcher of epidemic information read and how long they spent on each site  -- information Google apparently tracks and knows?  
11. What principles of responsibility, accountability, and liability would guide Google's thinking here in the total absence of Federal privacy law or policy?  

Bottom line:

Google is not worthy of a complete pass on privacy issues, especially when they deal with the enormously personal subject of peoples individual health.

At a minimum, Google has a lot more explaining to do to ensure people don't conclude the worst -- given that Google is viewed as 'hostile to privacy' by privacy experts and that American consumers have virtually no recourse if Google violates the most intimate aspects of their privacy.