Why would RBC even expose themselves to this liability? What was the point?

With every single one of these companies I am...baffled, that anyone thought this was a good idea, but in this situation especially it makes zero sense. All that liability for what possible upside?

I think this was intended to be a customer support channel and they had to be able to delete the messages containing bank info after a certain amount of time. I had read something about it, I don't think carte blanche access to users' messages was sought or given, it was just support conversations. I didn't use it so this is like my memory of 2nd hand info.

I used to work in Social Media customer support using a well known platform, in a large telecommunications company.

We could only access the private message history containing the conversations we had had with the individual, nothing else.

You think people care about their personal data, you should see what type of information they provide through private messaging platforms. Including through public posts, it's shocking.

Well, sure, there are always people that act against their own best objective interest but the case here is that Facebook is making a bad decision for them, and also not informing about it other than in broad, hard-to-grok language.

One reason would be that RBC was allowing people to send money from its app via Messenger - http://www.rbc.com/newsroom/news/2013/20131211-facebook.html