[impossiblefork]

Your phone number is personal information, so they are. They aren't allowed to save your phone number from your friend's phone scan in the first place.

Doing that kind of thing is a serious crime. In Sweden it'd be something like "unapproved intelligence activity against a person" with a multi-year prison sentence, since you're gathering data about someone by deceptive means. We're thus not talking about GDPR any more, but about prison sentences for espionage-adjacent stuff.