Found this online...worth a read.
"Only councils, the police, train operators and Transport for London can impose legally enforceable fines or penalties. A private parking company (PPC) or an individual can't. Even PPCs call their tickets “Parking Charge Notices”, not “Penalty Charge Notices”. In law, they’re called “speculative invoices”.
Any warning signs are usually so badly positioned and worded, that they won’t have created a fair and legally binding deemed contract between the car park owner and a driver entering the car park in the first place. See The Unfair Contract Terms Act 1997 and Excel Parking Services vs. Cutts, Stockport, 2011, 1SE02759, the Peel Centre case.
All the car park owner (CPO) can claim from a driver in damages for any breach of contract is what they’ve lost as a result. If this is a free car park or they paid, this is £0.00. Asking for more has been judged to be unreasonable and therefore an unfair contract penalty under the terms of The Unfair Contract Terms Act 1997, which is not legally enforceable. See Dunlop Pneumatic Tyre Co. Ltd. vs. New Garage & Motor Co. Ltd., House of Lords, 1914 and countless cases since.
What should I do now?
Don’t appeal to the PPC. They always reject them. What’s in it for them to let anyone off? Actually, there is something in it for them: information. They need to know the identity of the driver of the vehicle involved at the time, because that’s who the alleged contract was with. If they don’t know who the driver was, they have to make do with chasing the registered keeper.
With windscreen notices, an appeal letter will tell them your name and address, and maybe who was driving at the time. If they don’t know who the driver was, they have to buy the details of registered keeper from the DVLA. With postal notices, they’ve done this already. But they still need to know the identity of the driver.
They sometimes say that they have the right to ask for this information. This doesn’t mean that you have to tell them.
However, even if you’ve written and told them who the driver was, it doesn’t make their actions any less unlawful. It just means that instead of harassing the registered keeper, they can now harass the driver.
What will they do to me?
The PPC, then a debt collector and then a solicitor will send you a series of letters. The debt collector and solicitor are usually also the PPC, but using different headed paper. These letters will threaten you with every kind of financial and legal unpleasantness imaginable, to intimidate you into paying.
But, they can't actually do anything, for the same reason that a Nigerian e-mail scammer couldn't sue anyone who didn’t pay them.
What should I do then?
Continue to ignore everything you get from the PPC and their aliases. It does seem counter-intuitive to deal with something by ignoring it. Eventually, they will run out of empty threats, and stop throwing good money after bad."