Beyond Disclosure: Compositional Privacy Harm in AI Systems

Privacy law attaches obligations to each stage of information processing, whether it be collection, use, storage, or disclosure. We examine how legally cognisable privacy harm emerges across this full lifecycle rather than at any single one of these points. We argue that privacy risk in AI systems is compositional, arising from the interaction of memorisation, extraction, inference and contextual transfer. Disclosure is therefore not the sole threshold of privacy harm: legally significant consequences may emerge even where no underlying record is reproduced verbatim. Drawing on contextual integrity, we argue that privacy protection must extend across the lifecycle of AI-mediated information rather than attach to disclosure alone.