This is surely a breach of GDRP. One of the principles is that data must only be used for the purpose for which it was collected. Taking a number provided explicitly for 2FA and using it for search certainly sounds like a breach.
You have to realize that privacy is not a priority for most governments, so unless it's explicitly against the rules, I suspect they won't do much.
That's Facebook job to make it clear when it happens.
I don't know the actual text of law, but I guess even if you are friends with someone, you doesn't have any right over any of it personnal data, thus they wouldn't be able to use it except if you previously accepted that usage (being matched with someone you know using that phone number).
Source: Number articles over many years of laws being broken, Facebook.com still works and the POTUS is still the POTUS.