I consider the retroactivity not a good rule for a website, because a creative person can find more behaviors that are obviously wrong, but still not forbidden yet. For example, is there an official rule against hacking the server and deleting someone else's account? (Or, as an extreme example, finding the other user in real life and hurting them?) If someone did it, would it be okay to defend them saying: "well, it wasn't said explicitly that such behavior is forbidden, therefore we should protect their privacy"?

This raises the question: why do we bother posting rules at all, then?

And the answer, of course, is that such unwritten "rules" are not immediately obvious to everybody.