You're right that if a friend shares personal information we would rather be kept generally private, our friend is responsible for the privacy breach. But the person they share with can also be guilty.
Using a binary distinction (private/non-private) for privacy is unhelpful; it is more complicated than that. Things can be semi-private. Privacy is, more than anything, a matter of expectation. This means, among other things, that it is a messy and complicated thing (which it is) because people have different expectations.
You seem to be working off a definition of privacy that is close to "can be accessed by someone else" where in common usage the word means quite a bit more than that.
For example, if I'm talking to a friend in a coffee shop and someone sits down with a mic to start recording us, most people would acknowledge that they are invading our privacy. Perhaps they are legally able to do so. Some people might mock me for trying to have a private conversation in a public place. That doesn't change the fact that if I caught someone trying to listen in, I would consider it a Jerk Thing to do. Not on the basis of legality or even on practicality but on the basis of social expectation. I do not intend to share the conversation with them, nor do I expect them to access it.
Security folks tend to say things like "Expectation isn't a real barrier. You don't have any right to expect people to voluntarily not access things that they physically can." But that's a naive perspective, because social expectation is a real thing and it makes human interactions work.
Now it is true that if we abandon expectation as a real constraint, we will plunge into a dark and cynical world where everything that is not nailed down is for the taking, without recourse. But what I don't get is why we would want to do that. There are some who would say we are in that world; I'm happy to disagree with them.
I'm very happy to stay in the world where other people in the coffee shop would look at the person with the recorder and brand them creepy, because they're snooping - they're trying to access information that (whether or not they can) they're not invited to. I'm happy to keep expectation as a real barrier.
So for example, if you tell your mother your girlfriend's name, it might be a breach of privacy, depending on whether or not she expects you to do so. Your mom might be her boss...
In this case, Facebook is definitely doing a Jerk Thing and violating privacy, because they're working out of sync with peoples expectations. They ask for information for a presumed purpose (to populate your Facebook account) and then use it for an additional secret one.
For instance, if I lent my physical address book to a friend for the purpose of sending out wedding invitations for me, and they made a copy of it so they could flog their pyramid business, you can bet that my friends would be mad, but they would also accept that I was betrayed and that the real privacy violation was on the part of someone who used information they had access to in a way that was not invited or expected.
The right language of what is happening here is that of betrayal and privacy violation.