Have you explicitly authorized them to provide you search and mail-based information in Google Now?

No idea, I don't use Google Now. I hope so, but it wouldn't surprise me if Google "forgot" about that step. But at least that's for the benefit of the user.

According to my understanding of Google's privacy policy, your account data is essentially global by default, they don't need to explicitly ask you service by service where they can use it. IANAL, though.