That clause only applies to criminal offences under the Data Protection Act. This was a Civil Monetary Penalty which the ICO has levied for a breach of the 7th Principle.
Breaching the Principles is not in itself a crime (hence "Civil" Monetary Penalty). There are crimes under DPA, for example unlawfully obtaining personal data.
The charity *should* have contracts in place with the website provider that allow them to recover the cost of the fine on the basis that the contractor didn't do the job properly......bet they don't though.