By itself, Google's new flu tracking program is more of a cool idea than a threat to your privacy. Google is not turning over search results to the CDC, but rather is making information about them available through a public web application. The initial results look promising, as the CDC said that their data and Google's were very close to one another; close enough to predict the flu trends of the past few years.

The danger here is one of mission creep. It'll start with the CDC, and eventually law enforcement agencies are going to want to get in on the act. The Department of Justice has tried unsuccessfully to get a data retention mandate for ISPs and major websites (I've written extensively on this subject). If this project turns out to be successful, then it'll be another argument that the DoJ will be able to make in favor of why it needs a data retention mandate and access to search data.

A year or two ago, Google turned down the Bush Administration when they came knocking, looking for a lot of free data that they could use in defense of the Child Online Protection Act in court. Google turned them down on principle and basic business sense. It made no good sense, for either reason, to give the government the impression that Google would roll over and die the moment it came looking for information on its customers. However, if it can be proved that datamining their search results is an effective process for protecting public safety, they may not receive such a sympathetic hearing in the future in federal courts or before Congress.

It's easy to forget how weasely government bureaucrats can be in making arguments for expanding their power. The USA PATRIOT Act was almost entirely ready to go right after 9-11 because the Department of Justice had been merely looking for a good argument to use in favor of most of the language in what would become the USA PATRIOT Act. Google has already faced concerns from the European Union and the federal government over its practice of anonymizing logged search data after nine months because of the perceived forensics implications that come with that. It would not be far-fetched in the least to see the EU and federal government at some point saying that, as proved with the flu tracking program, there is a public interest in them not anonymizing their logs and datamining the trackable information.