Data Protection's Composition Problem