Easy way to deal with it

What is required is a new law which binds a person to secrecy over *any* information which was not specifically volunteered to them and which does not constitute evidence of a criminal offence. In other words, make the person who acquires the information responsible for not disclosing it.

So looking at the contents of someone else's hard drive wouldn't be an offence in and of itself; but telling any third party what you found there (and that obviously includes using any credit card numbers you found) would be, unless you found evidence suggesting that a crime had been committed.

The same principle could also apply to used hard drives. (Mind you, anybody who doesn't do a full surface scan on a second-hand HDD -- which necessarily obliterates any pre-existing data -- before using it for anything important is an idiot).