Did someone access personal data to discover that someone was taking a certain flight, or did someone recognize someone's face on board and later on told a friend that he saw Person A because he ran into him on a flight? If you just recognize someone because you happen to know him via via there's no access to personal data as such, that's just your memory remembering you see someone and your indiscreteness of gossiping to someone else.

Regardless of GDPR I would say, though, that flight attendants need to be discrete about which passengers they encounter. Confidentiality should be in the nature of their work attitude. They know a lot about their passengers: they see what they (don't) eat, where they're flying to, with whom and how they interact. All that information should be treated in a discrete way.