Yes... a complete FUBAR. NI resident... no Keeper liability. They had no idea who the driver was until the Keeper blabbed it to them. The Keeper could never have been liable and there is no legal obligation on the Keeper to identify the driver to an unregulated private parking firm.
So the no Keeper liability winning point has been blown away, not on one point but on two!!!! Bristol Airport, as with any other UK airport, is land covered by by-laws and as such, there can be no Keeper liability.
If you have written evidence (a phone conversation is not worth the paper it isn't written on) then keep it handy.
Stop talking to the bottom-dwelling and utterly powerless DCBL. Debt collectors are powerless to do anything except to try and persuade the low-hanging fruit on the gullible tree to pay up out of ignorance and fear. Never, ever, EVER communicate with a powerless debt collector. Just one more thing you have done wrong here.
So, how is this salvaged... let's break this down into what we know and what we know can and can't be done about anything.
You lawfully stopped at red traffic signals—as required by statute—not out of choice. That collapses the very premise of VCS’s ‘no stopping’ allegation. There was no voluntary act, no offer, and certainly no contract.
Even if you entertained the fiction that a contract existed, it wasn’t you who breached it. The adult passenger exited of her own volition. You were behind the wheel at a red light—not issuing commands like a chauffeur in a uniformed cult. Under contract law, you cannot be held liable for the independent act of a third party unless they’re your agent or under your control. Neither applies here.
Then, the jurisdictional hammer: you reside in Northern Ireland. There’s no PoFA keeper liability, and no reasonable prospect of enforcement through an NI court over a Ł100 speculative invoice. VCS would have to issue fresh proceedings in NI or attempt to register and enforce a foreign judgment. They won’t—not unless they fancy losing money and face.
As for DCBL, as I already pointed out, they are legally inert. They have no authority, no power, and no role except to prey on ignorance and fear.
What matters now is paperwork. You’ve got confirmation the case was closed. If VCS are using your personal data beyond that point without lawful basis or notification, that’s grounds for a UK GDPR complaint and possibly a claim under Section 168 of the DPA 2018. And if they try sending another demand, you’ve got all the ammunition you need.
File everything. Say nothing. Respond only to a court claim—from a Northern Irish court. If that happens, come back for further advice, but I do not expect that you will because nothing is actually going to happen unless you further FUBAR it by trying to respond to anything else that they send you.