I think the deal with photos is they could be posted publicly and then inadvertently passengers could be identified. The difference here is more akin to the Celeb thread, where a particular person (who is known to the observer) is seen, and this single event is reported (in public).

In OPs case even the observation was communicated essentially in private, making it even less of a privacy issue (if instead the FA later on had spoken with the friend in person that X was on the flight, would that be an issue?). Without knowing the full context it could be considered creepy/stalking, but also could be nothing more than a friendly "Oh I've seen seen X on my flight, how cool!"

If instead the FA had scrolled through their Ipad looking at pax with the sole intention to identify any they might know, that could be a GPDR issue.