If their servers have been compromised to leak the data, should be. They ran the survey and UK and European data protection law makes data leaks the responsibility of the data holder.

Yes, they will probably be the information controller under the DPA and have to be extreamlly careful that our data is safe. Even keeping a copy in a non EU country is very hard.

Why would jurisdiction enter into someone in the UK suing the company that processed the UK census data? Thier data. I don't know if antihero is in the UK, but if they aren't, people in the UK should do it instead. I am disturbed that my data could leak like this.

As you would expect, there is a legal entity for Lockheed Martin in the UK. Unless there is some crazy immunity for companies working on government contracts (which wouldn't surprise me) I don't see why they couldn't be sued.