For heavens sake, the ONLY requirement is that the driver is not identified. There is no need to lie about anything. It just makes this so much more difficult when you try and obfuscate who is who by referring to a passenger or a driver or the Keeper.
It is simple: who ever is narrating this, whether as the Keeper or as a passenger or even as the driver, all you need to do is reference the driver in the third person. Ideally, it should be the Keeper narrating this.
Your opening post blew away your cover story because you said you were a passenger and you also received the Notice to Keeper (NtK) which means that you, the Keepermweremnot driving. Even if you had been driving, your would not have had to lie about anything.
VCS have absolutely no idea who was driving and the only way they would know is if the Keeper blabbed it to them. All the Keeper has to do is not say something stupid like “I did this or that”, only “the driver did this or that”.
However, if you are not the Keeper, then why isn’t the Keeper posting this? If necessary, just narrate as though you were the Keeper, if you are doing this on their behalf. It just makes everything so much easier to deal with.
As the V5C was not updated at the time of the alleged contravention, it is too late to appeal. You can submit a formal complaint that the PCN was never served but you are dealing with one of the scummiest private parking firms and they are IPC members. So, even if you were able to persuade them to allow you to appeal and the amsecondsry appeal to the IAS, you will be wasting your time.
If there has been no contact with anyone yet, then I would advise you to simply wait for a Letter of Claim (LoC) and the deal with it from there. As long as the driver has not been identified, the Keeper cannot be liable.
The odds of a claim actually going as far as a hearing are extremely slim to none. Just as with the debt recovery letters, they are assuming you are low-hanging fruit on the gullible tree and can be intimidated into paying out of ignorance and fear.
For now, they are assuming ONLY important thing you must do is send the DPO of VCS a data rectification notice instructing them to update their records with the Keepers current address for service and to erase any other addresses they hold. The highlighted words are there for a reason, so use them. That’s it.