Update on this one: both of the PNs that were 'incorrectly' transferred to me were cancelled based on my appeals (shortly after I sent the complaint). I also received a response to the complaint on Saturday - stating the third (the one they refused to transfer from the keeper) has also been cancelled.
That hopefully means that any risk of the keeper business paying is gone - unless there are any more to follow!
Along with confirmation, I got what I think was meant to be an actual response to my complaint - but is clearly insufficient.

I intend to respond as follows:
Dear [COMPLAINT HANDLER],
Firstly, thank you for confirming the final ‘Penalty Notice’ has been rightfully cancelled.
I may be misinterpreting, but the tone of your message somewhat suggests this is your formal response to my complaint. I’m sure I don’t need to remind you but per the Private Parking Sector Single Code of Practice 11.4:
A full response to a complaint must be provided by the parking operator within 28 days of its receipt unless exceptional circumstances apply, in which case the complainant must be kept informed by the operator.
To be clear, I wouldn’t expect you to "comment on internal processes and their outcomes” per your message, but I do expect a full and thorough response to the real concerns raised in my complaint. In summary:
1. Why are you, an unregulated parking company, issuing fake “Penalty Notices” which appear designed to mislead motorists that you have authority that you do not?
2. Why are you even suggesting that Railway Byelaws are remotely relevant in cases of minor parking indiscretions on railway land?
3. Why are you suggesting that a private parking ‘appeals process’ is even vaguely relevant in the case of a breach of Railway Byelaws?
4. Why are you wrongly claiming you have any legal basis to infer the owner of a vehicle based on its registered keeper?
5. Why between your different communications are you unclear on which party you are trying to hold accountable?
6. Why between your different communications are you unclear on what alleged contravention has even occurred?
7. What failing has occurred that your customer service team think it’s acceptable to ignore a customer asking reasonable questions?
8. What failing has occurred that two different members of your customer service team have different views of what information it is okay to share with a customer?
9. Given I was told that information was disclosed to me that shouldn’t have been, what assurances can you offer that my personal information, and that of your other customers is safe?
10. On what lawful basis under GDPR have you been processing and storing my personal data?
Regards,
[G6PRK]
@b789 would appreciate any thoughts you have on this?
My intention is to exhaust communications with APCOA and then prepare a pack to send to the local MP and maybe the local press.
As a related aside, another car which I am the registered keeper of is likely to receive NtKs in the next week or so, so will be interested to see what the process is like in that case.