if it were illegal for Visa EU to transfer this data, why would they do so? They admitted it in writing., page-2

They're obliged to notify under GDPR. The size of one's legal team does not excuse oneself from meeting basic compliance obligations, especially if you've already 'breached'.

In other words, make good. Don't compound one mistake with a mistake.

As for the original 'breach', they didn't have consent from isx customers to use their information in this way. Remember, ASX has no jurisdiction in the EU. The admission essentially confirms the breach.