According to US law, any online service provider that receives actual knowledge that child porn exists on their services is required by law to report it to the National Center for Missing and Exploited Children... or face a fine of $150k for a first offense, or $300k for subsequent offenses:

http://www.law.cornell.edu/uscode/text/18/2258A

To my knowledge, Google wasn't required to check its hosted files for specific image hashes: "Nothing in this section shall be construed to require an electronic communication service provider or a remote computing service provider to— (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively seek facts or circumstances described in sections (a) and (b)."

But once they did, they were required to report the results. Any privacy concerns are waived as an "[exception] for disclosure of communications" as part of 18 USC § 2702: "Voluntary disclosure of customer communications or records". http://www.law.cornell.edu/uscode/text/18/2702

It's not surprising that Google is affirmatively scanning its servers for child porn, as they have a long history of providing assistance to NCMEC:

http://googleblog.blogspot.com/2008/04/building-software-too...

http://googlepublicpolicy.blogspot.com/2012/01/crowdsourcing...

"$1 Million from Google to Fight Child Sexual Exploitation Received by the National Center for Missing & Exploited Children" http://www.missingkids.com/news/page/4898