It's a good question, and I'm happy to work through it with you.
If we step back, under PIPEDA we have the ability to collect and use without consent when we have reasonable grounds to believe it would be useful in the investigation of a contravention of law of Canada and the information is used or collected for the purpose of that investigation.
Then we move to subsection 7(3), which is disclosure without knowledge or consent, and in this section there is no ability for an insurance company to disclose to anyone other than to a government institution or an investigative body. And yes, you're correct, the life and health insurance companies do not have an investigative body.
The CBA has an investigative body. The Insurance Bureau of Canada may have an investigative body. But the life and health insurance industry does not.