How does anonymity actually get enforced, not just labeled?

Department and group breakdowns respect a configurable minimum group size. If a department has fewer employees than that threshold, its scores are suppressed from the breakdown entirely rather than shown as a de-facto individual score dressed up as an average, this was specifically fixed and tested to actually enforce the rule, not just display it as an available setting.