Does storing personal staff information (names, addresses, dates of birth) on a shared network drive that allows anonymous and unrestricted access to all staff present a violation of the 7th principle of the data protection act - "To keep information secure"? Or is there a presumption of trust in the organisation for users and as there is no public access, it could be considered technically secure?
Yes that would count as a violation, if you consider principle no.2 that PII should only be "used for limited, specifically stated purposes" then unless every single staff member with access to that shared drive has a need to access that data for one of the "specifically stated purposes" (which I'd imagine is highly unlikely) then they have failed to comply with the "safe and secure" principle.
Unless the organisation has prior form for shady behavior in this area I'd be inclined to say Hanlon's Razor is at work here and that might influence how you approach the issue with them but it is definitely something I'd be raising ASAP.
The bigger question is if this violates the data protection laws of various jurisdictions (it does). From this perspective, you have not secured PII and it's a violation.
For instance, no one, NO ONE has any right to know how old I am. I do not want to be subject to discrimination, and my birthday is private information. If I found out that my employer posted that info internally, I would be calling up the meanest lawyer I knew.
No one needs to know this info except for HR, which means if it was posted, then is not being used for the purpose that it was collected.