Who “owns” the privilege?

Only the client owns the privilege, but it can be inadvertently broken by communicating the confidential information to a third party.