Can smartphone spyware work even if there is no data connection?

Yes, it's possible. A malware can simply utilize the SMS functionality in your phone to transmit formatted data from and to your phone. Heck, it might even use DTMF.

Update: After your edits, your question turned from acceptable to really bad. In any case, the most plausible scenario here is via Bluetooth.

However, I think you're just very paranoid and/or you have some troubles with your roommate. Solving this issues can't be done with hacking/counter-hacking.

There are other two options that come to mind:

• text messages
• caching of information

Text messages was shown by Georgia Weidman back in 2011. The botnet comms ran through SMS. So you can imagine it can be quite easy to spread information by SMS.

The other option would be to store the information you used and upload it the next time you have an internet connection. This might be when you connect to the internet through Wifi or internet connection sharing when updating your smartphone.

If your roommate got access to your phone once to install spyware, what's to stop him finding another opportunity to read the cached results of the surveillance?

Who needs a data connection?