By having the salt secret they are using it as an encryption key that they hope will prevent any sort of brute force attack. Thus the hash is no longer covered

By having the salt secret they are using it as an encryption key that they hope will prevent any sort of brute force attack. Thus the hash is no longer covered by privacy legislation. A separate salt per record is still brute forceable, even if it takes a lot longer for a lot of records.