You have not receive any PENALTY. You received a speculative invoice from an unregulated private parking company for an alleged breach of contract by the driver. It is an invoice. Just because you received an invoice does not mean you are in debt to them, especially if you dispute it. Only a judge could confirm whether you are in debt to them and if you have not yet had any contact with them about this "invoice", good.
What you must NEVER EVER do is identify the driver. They have no idea who that is unless you, the Keeper, blab it to them, inadvertently or otherwise. There is no legal obligation on the Keeper to identify the driver to an unregulated private parking firm. The ONLY liable entity is the unknown (to them) driver.
Because their Notice to Keeper (NtK) was not "given" (delivered) within the "relevant period" of 14 days beginning with the day after the date of the alleged contravention, they cannot rely on the provisions of the Protection of Freedoms Act 2012 (PoFA) to transfer liability from the unknown driver to the known Keeper.
So, as long as you only refer to the driver in the third person, they cannot hold you liable for the charge. No "I did this or that", only "the driver did this or that". Don't tell 'em your name Pike!
AS already advised above, the very first thing you must do is email the Data Protection Officer (DPO) of TPS a Data Rectification Notice (DRN) instructing them to update your current address for service and to erase any other addresses they may hold for you. The highlighted words are there for a reason, so use them.
As soon as you have done that, you should send a formal complaint which can include an appeal, which they will reject anyway but require them to provide a POPLA code for a secondary appeal, for what it's worth.