You have a risk/cost - benefit problem here, with basically three factors:
- How much you trust the person manipulating the tablet
- The cost of the tablet
- The potential damage of the data that was stored there being accessed.
Only you can decide the course of action that is most appropriate for your case and personal preferences.
Now, there are a few things you may do to lower the risk of potentially private data being accessed:
- You can request a remote wipe of the device. If the tablet is made functional again (and able to connect to the internet), it will receive the command and wipe itself.
- You can invalidate the tokens and even change the password for the accounts which are setup in the device (note this can be incompatible with the previous point). Thus, it won't be able to gather new data (eg. start receiving your new emails) and, depending on the app, may even not show data which was previously downloaded.
- Obviously, you don't want to give him the passwords for the device. This may by itself be enough to avoid him accessing your data.
- You invite your friend to come to your home and attempt together to fix the tablet.