You are (provincial legislation dependant) correct.
That is why they are asking for it, in exchange for a discount on the insurance. It is hardly a break of privacy, when you have to consent for the credit check! Really not sure what the big deal is here - I'd understand a bit more if they were refusing policy renewals to anyone who did not submit to a credit check, but here they are merely offering a discount for those who allow them to run a credit pull.
I'm really missing where the issue is here? They obviously have some kind of modelling information that projects a higher risk of insurance fraud when a policy holder has a poor credit history (or are planning on illegally selling all your data as Poutinesauce worries about...).