Which isn't used for people. That's one of the first rules of writing you need to know, and the first rule of using that/which and who/whom properly.
I've talked (a lot) about proper use of the word that in the past. It's one of the most over-used and under-valued words in the English language. I find it shoved in everywhere when I'm reading, and my experience is that it can be eliminated at least half the time. But one of the most important rules of using that and which is often ignored: it's not for people.
That and which are used for items, things, businesses and all other inanimate (non-conscious) objects. These words are not used to describe people. For example:
I saw the blue folder that was on the desk.
I'm talking about a thing or an object, so I'm using the word that. In this example, I could just as easily use which instead. I can't use who.
I saw the blue folder who was on the desk.
The blue folder has no consciousness, so it's not a who. By the same token, if I replace the blue folder with a person, I have to stop using that.
I saw Carl, who was on the desk.
People often use who incorrectly when that should be there instead. For example, companies and corporations are often dignified with who when clearly this is incorrect. I found a Huffington Post article in which Wal-Mart is referred to as a who. Wal-Mart is not a people, and although it may be made up of people who work and shop there, Wal-Mart is the brand name of a business and not a person.
However, that is sometimes used for people in writing. Some writers have specifically used it as a device and some use it to more accurately reflect the way people actually speak (because it's done a lot in everyday dialogue). It's been done so much, in fact, that some reputable sources have accepted it as proper grammar -- the American Heritage Dictionary says that can be used for people, sometimes, as a reflexive pronoun.
It is acceptable in all but strictly formal writing, and sometimes in dialogue it sounds a lot better to call someone a that than a who. For example, "Mike? The guy that came in first in the marathon last year?" Strictly speaking, who should supplant that, but you're more likely to hear someone use the latter in everyday speech (because enough attention isn't paid to the majesty of good grammar in schools, but I digress). And either way, it can't go in the opposite direction: Wal-Mart still can't be a who. That is flexible, sometimes, but the who rule isn't.