Businesses may run the risk of prosecution if data thieves get their hands on discarded technology, says Chris Spooner