No, not really. So long as they're not disclosing it to anyone else and are keeping it for a reasonable amount of time, and so long as you have access to it, they'll be fine.
The DPA just restricts how companies can store personal details, it doesn't restrict them from doing it altogether.
Yes but there are controls in place to secure this information and how the information is to be used. Personal data is only meant to be kept for a certain time, and disposed of securely. Do they lock this data up at night? A book is a bit of a poor way to log this info. Giving your name and DOB is fine, but the address is a little tenuous for this activity where there is no legitimate reason for it.
This is the questions that typically you have to answer "yes" for. This list isn't exhaustive and there are exceptions.
•Do I really need this information about an individual? Do I know what I'm going to use it for?
•Do the people whose information I hold know that I've got it, and are they likely to understand what it will be used for?
•If I'm asked to pass on personal information, would the people about whom I hold information expect me to do this?
•Am I satisfied the information is being held securely, whether it's on paper or on computer? And what about my website? Is it secure?
•Is access to personal information limited to those with a strict need to know?
•Am I sure the personal information is accurate and up to date?
•Do I delete or destroy personal information as soon as I have no more need for it?
•Have I trained my staff in their duties and responsibilities under the Data Protection Act, and are they putting them into practice?
•Do I need to notify the Information Commissioner and if so is my notification up to date?
I'm sure in terms of the Co-Op this is not yes to all the questions. - whilst answering yes doesn't guarantee compliance, it's a good starter for 10.