They are talking more nonsense.
You could reply with the following;
To whom it may concern,
Thank you for your recent response which I received today.
Unfortunately, your response is totally irrelevant to matters at hand as your initial letter was a Penalty Charge Notice to the vehicle owner.
In the first instance, the Single Code of Practice is only relevant to private parking notices whereas this dispute is a statutory matter involving a penalty notice.
You seem to get rather muddled and have trouble separating a statutory notice from a notice which relates to breach of contract?
Secondly, in your reply you set out Annex C (from the CoP) and specify that it can be assumed that the registered keeper was the driver - this point is totally irrelevant since the Railway Byelaws make it very clear that it is the vehicle OWNER who is responsible for the penalty - so, even if you assume that the registered keeper was the driver, you have still not established any liability since only the OWNER is liable.
Obviously, if the Railway Byelaws wished to make the driver or the keeper liable then the wording would reflect that point - they would only need to have changed the word "OWNER" to either "keeper" or "driver" if they wished to make a different party liable but clearly they don't do that.
Furthermore, there is no "outstanding balance" since this is not a contract dispute - this is statutory law and no debt exists - you need to take this to a Magistrates Court to progress this matter.
Moving on...
In your reply you acknowledge the serious data breach which has occurred.
During the breach you wrongly supplied my personal information to a third party company.
As a result of the breach I have now received a series of threatening letters from some sort of debt collections agent.
Not only did you wrongly supply my personal data but you incorrectly told the debt collecting company that both a debt existed and that I owed it, when, in fact, no debt exists - you haven't won in the Magistrates Court yet!
I note with interest that these parking operator data breach cases normally settle in Court for between £600 and £900 plus costs.
Given that you have admitted the data breach at the earliest stage, I am happy to offer you the chance to settle 'out of court' for £400 (plus the parking operators standard £70 which covers the genuine cost of writing letters and obtaining legal advice etc).
So a total settlement figure of £470 which you may pay by cheque within 14 days.
If you wish to pay by bank transfer then bank details can be supplied.
I look forward to your reply.
Have a great weekend.
Best wishes,
xxxxxxx xxxxxxxxx