There seems to be a firm belief in some circles that
- "Who refers to people, and that refers to things."
Unfortunately, this belief is incorrect, at least in the second part.
As usual, things are more complicated than simple slogans can explain.
Who is a wh- pronoun, which certainly does refer to people, and only to people (though this is
true only of who and whom -- whose can refer to any possessive noun phrase, human or neuter).
However, that is not a gendered pronoun; it is a demonstrative pronoun being used as a
complementizer; demonstrative pronouns can refer to anyone or anything.
- Which/What lollipop do you want? That one.
- Which/What do you want? That lollipop.
- Which/What man assaulted you? That one.
- Who assaulted you? That man.
And, while it is a complementizer without any meaning and with only a marking job to do, like the to of infinitives or the -ing of gerunds, that does retain enough of its pronominal status to take the place of the relative wh- pronoun.
- staff who may have this information
- staff that may have this information
are both fine and mean the same thing and are correct and conventional and fluent speech. Nobody ever notices the difference. But that and who never occur together, in either order; choose one.
- *staff who that may have this information
- *staff that who may have this information
In fact, both are frequently omitted when they are not the subject.
- staff who we talked to
- staff that we talked to
- staff ___ we talked to
are also just fine, equivalent, grammatical, and correct.
(One can also use whom, but let's not, OK?)
I suspect the source of this confusion is that the difference between who and that seems to resemble the difference between who and which in relative pronouns. Both who and which are gendered wh- pronouns: who is for humans, as noted, and which is for neuter nouns.
Those who don't know better might apply the who/which rule to who/that, even though it's wrong.
Any old rule in a storm, apparently.