In addition to all the spam, uptime and backup features, Google has some of the best security infrastructure out there. I've really wanted to move away from using Gmail for a long time, preferably to my own personally-controlled e-mail server, but I know for a fact that I won't be able to lock down my server nearly as well as Google locks theirs down. Even if I were to spend an inordinate amount of time keeping up with all the security patches and configurations and such, Google is going to be notified ahead of time of critical new exploits, plus they seem to have their own people working on finding such exploits.

In the end, you have to make the tough choice between whether you want to make a controlled, voluntary disclosure of your private information (e-mail text and metadata) to Google, or risk an uncontrolled, involuntary disclosure of that private information to potentially malicious actors.

My hope is that we'll get some technological infrastructure solutions to this quandry through the next generation of privacy-preserving communications protocols that are currently being worked out (Tox, BitMessage, Flowingmail, etc - not endorsing any of these, just examples of the current crop). Even then, it'll be a while before we can securely protect both our data and metadata.